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SECRET //NOFORI- 
FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U/7FOvS} Missing 1tem-[___——id Date: 05/06/2019 +a 


302-1A20 


From: WASHINGTON FIELD 
WF-CI13 


b7c 
Drafted By: [7] 
case ip #:[—«dSs() SV At MIDYEAR EXAM; b3 


MISHANDLING OF CLASSIFIED; b7E 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U//F686}+ To document missing item | ee 


which is described as "FD-597 Receipt for Property" acquired from 
Williams & Connolly LLP 


assify On: 20 


Reference: [__séi302 Serial 23 b3 
b7E 


Details: 


(U//FOt8) For reference, Washington Field Office (WFO) CI-13 has been 
gathering and copying materials from captioned case in response to a 
Freedom of Information Act (FOIA) tasking from Information Management 
Division (IMD; formerly Records Management Division). 


(U/ APe8e}- On or about February 4, 2019, Special Agents (sas)[___| i 


[————Jattempted to tocate [+ 302-1820, A 


described as described as "FD-597 Receipt for Property" acquired from b7E 
Williams & Connolly LLP (see referenced serial). The SA's looked 


SECRET/ /NOFORN— 


HRC-13978 


SECRET/ 7NOFORN- 
Title: (U/ APe8ey+ Missing Item -L_____f302-1a20 


Re: 05/06/2019 


through all case materials in the CI-13 file and workbox area, 
however, they were not able to locate this item. 


(U/ Posey SA inquired with Supervisory Intelligence Analyst 
(SIA) regarding the item, as he was previously the IA 
assigned to the case. He was also not able to locate this item. 


(U/7FO86} As such, WFO CI-13 considers the item missing and will 
enclose this document into 1A20 as a placeholder until the missing 
item is located. 


+o 


SEGRET/ ANOFORN- 
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ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-03-2016 BY 376318T80 NSICG 


FD-302a (Rev. 10-6-95) 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 1/7/2016 


(U/FORS) On January 7, 2016, writer received a 15 page fax a acrons 


Agent in Charge at the U.S. Department of State, Office of Inspector General. The faxed documents 
consisted of time and attendance records for Bryan Pagliano. 


(U/2QU0) The faxed documents are enclosed in an attached 1A. 


Investigation on __1/7/2016 at Washington, DC b3 per 


b7E FBI 
File # ae Date dictated__ N/A 

b6 per 
By 
7 see 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your ageney. 


HRC-853 


b7E FBI 


HRC-858 * 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 05-06-2019 BY Cé6wW46B1i1 NSICG 


FD-1087a (Rev. 5-8-10) 


Seng Herons. 


FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 


(U) 
Event Title: )X) DOS Date: 


casei #:[ «ids gy} OX//#P) MIDYEAR EXAM; 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER 


Full Investigation Initiated: 07/10/2015 
Collected By: Missing on Missing 
Collected From: Department of State 
Receipt Given?: No 

Holding Office: ‘WASHINGTON FIELD 


Item Type Description 

1B Digital (v) 1.cp Marked[_————_—i|sas 
Collected On: 01/28/2016 
Seizing Individua 
Located By: 
Location Area: NA 
Specific Location: NA 
Device Type: Compact Disc/Digital Video 
Disc (CDs/DVDs) 
Number of Devices Collected: 1 


02/01/2016 


b6 per FBI 
b7C per FBI 


b3 per FBI 
b7E per FBI 


(SIM) 


b6 per DOS, FBI 
b7C per DOS, FBI 


HRC-859 


e ® 
(0) SSCRET/7NOFORR 


Title: DOS 
2 [ } b3 per 
Re: 02/01/2016 Eee ea 


+o 


SECRET/ /NOFORN- 
2 


HRC-860 


33 b3 per 
SECRET aie 


HRC-861  * 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
8 DATE 05-06-2015 BY Cé66w46B11 NSICG 


cia Record 


FD-1087a (Rev. 5-8-10) 


~SRERET AWOPORN- 
FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 


Event Title: (U) EMAILS Date: 02/03/2016 
b6 per FBI 
b3 per FBI 
case 1D #: [7 id if} SARE MIDYEAR EXAM; TE per FBI 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 


SENSITIVE INVESTIGATIVE MATTER (SIM) 


classify On: 20411 
Pull Investigation Initiated: 07/10/2015 


Collected By: Missing on Missing 


7 b6 per DOS 
Collected From: SPECIAL ASST, DEPT OF STATE b7C per DOS 


Receipt Given?: No 


Holding Office: WASHINGTON FIELD 
b6 per DOS, FBI 


Item Type Description b7C. per DOs, FBI: 
1B Digital (U) 2 pyps: openner[_—s#EMAIL - 2011. Pst 

OPENNER| EMAIL - 2012.PST 

Collected On: 02/03/2016 

Seizing Individual: 

Collected By: 

Location Area: DEPT. OF STATE 

Specific Location: DEPT. OF STATE 

Device Type: Compact Disc/Digital Video 

Disc (CDs/DVDs) 

Number of Devices Collected: 2 


TSBCRETT, ‘/ROPORN— 


HRC-862 


@ 
DS5caeT/+eronn— 


Title: U) EMAILS 
Re: 02/03/2016 


+ 


b3 per 
b7E FBI 


HRC-863 


ABA 


b3 per 
b7E FBI 


HRC-864™ 


ALL FBI INFORMATION CONTAINED 
a HEREIN IS UNCLASSIFIED 
DATE 05-06-2019 BY Cé6wW46B11 NSICG 


FD-1087a (Rev. 5-8-10) 


“Brent /Averonn- 
FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 


(0) F 
Event Title: }&{ DVD provided by DoS Date: 02/08/2016 
b6 per 
apy:[ P 
Approved By b7c FBI 
prafted py:[__ 
b3 per 
case iD #:[—«|:s{)- D/A) MIDYEAR EXAM; iaateae 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Declassify On: 20261231 
Full Investigation Initiated: 07/10/2015 
Collected By: Missing on Missing 


collected From: [_____ B6 per 
Department of State b7c DOS 


Receipt Given?: No 
Holding Office: WASHINGTON FIELD 


Item Type _., Description 
1B Digital (} pst DVD provided by Dos containing emails flagged 
during the FOIA process. 
Collected On: 02/05/2016 
Seizing Individual: b6é per 
Collected By: b7C FBI 
Location Area: NA 
Specific Location: NA 
Device Type: Compact Disc/Digital Video 
Disc (CDs/DVDs) 
Number of Devices Collected: 1 


SSBERET/7NOFORN- 


HRC-865 


BEerel7/Nerenn— 
TD) 


Title:! DVD provided by Dos 
Re: 02/08/2016 


+ 


b3 per 
b7E FBI 


HRC-866 


Aas Bpsrer Ba Pee 
b7E FBI 


HRC-867 * 


FD-1087a (Rev, 5-8-10) 
 SeeRsE7Aroron— 


ALL FBI INFORMATION CONTAINED 


e HEREIN IS UNCLASSIFIED 


DATE 05-06-2019 BY Cé6W46B11 NSICG 


FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 


Event Title: (U) DEPARTMENT OF STATE HQ Date: 02/10/2016 


ee at 
Drafted By:[ 
case i: gt) XC AHPMIDYEAR EXAM; 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Derived 
Sources 


Full Investigation Initiated: 07/10/2015 

Collected By: Missing on Missing 

Collected From: [| DEPARTMENT OF STATE 
Receipt Given?: No 


Holding Office: WASHINGTON FIELD 


Item Type Description 
1B Digital (U) ONE (1) DVD LABELED FIELD BM FILES AND MARKED 
SECRET. 


Collected On: 02/10/2016 

Seizing Individual: 

Collected By: 

Location Area: DEPARTMENT OF STATE HQ 
Specific Location: ROOM 6316 

Device Type: Compact Disc/Digital Video 
Disc (CDs/DVDs) 

Number of Devices Collected: 1 


b6 per 
b7C FBI 


b3 per 
b7E FBI 


b6 Per 
b7c DOS 


HRC-868 


SECRET /NOFORN 
Title: (U) DEPARTMENT OF STATE HQ 


re: [____| 02/10/2016 b3 per 
b7E FBI 


o¢ 


HRC-869 


b3 per 
b7E FBI 


HRC-870 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 05-06-2019 BY Cé6wW46B11 NSICG 


FD-1087a (Rev. 5-8-10) 


JSEcRET/ AoroRN— 
FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 
Event Title: (U) DEPARTMENT OF STATE Date: 02/10/2016 
nee ws b7C per FBI 
; b3 per FBI 
case 1p 4: ] (0) Xaver wrvenn exam steele 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Sources 
assify On: 2041) 


Full Investigation Initiated: 07/10/2015 


Collected By: Missing on Missing 


b6 per DOS 
Collected From: Co) a | b7C per DOS 


Receipt Given?: No 
Holding Office: WASHINGTON FIELD 


Item Type Description 
1B Digital (0) ONE (1) DVD LABELED [-—__Jewar 2012 Bae see poe got 
Collected On: 02/10/201 i 
i Seizing Individual: 
Collected By: 
Location Area: DEPARTMENT OF STATE HQ 
Specific Location: ROOM 6316 
Device Type: Compact Disc/Digital Video 
Disc (CDs/DVDs) 
Number of Devices Collected: 1 NM 


~pscaer7inorene 


HRC-871 


6 @ 
_spcant/Herenr 


Title: (U) DEPARTMENT OF STATE 


b7E FBI 


+ 


HRC-872 


b3 per 


bay SESRET b7E FBI 


‘oe 


sy 
HRC-873 


FD-1087a (Rev. 5-8-10) 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
@ DATE 05-06-2019 BY Cé6é6W46B11 NSICG 


—SEeRET] /NOFORN- 
FEDERAL BUREAU OF INVESTIGATION 


Evidence Entry 


Event Title: (U) DEPARTMENT OF STATE Date: 02/10/2016 
b6 per FBI 
approved By:[ BIC per FBI 
b3 per FBI 
Case ID #: a (0) 03/7 Ate} MIDYEAR EXAM; b7E per FBI 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Full Investigation Initiated: 07/10/2015 


Collected By: Missing on Missing 


b6 per DOS 


Receipt Given?: No 
Holding Office: WASHINGTON FIELD 


Item Type Description 


1B Digital (U) ONE (1) DvD ess ——— iy 2012 
Collected On: 02/10/20 b6 per DOS, FBI 


Seizing Individual: BICsper DOS, FBT 
Collected By: 

Location Area: DEPARTMENT OF STATE 

Specific Location: ROOM 6316 

Device Type: Compact Disc/Digital Video 

Disc (CDs/DVDs) 

Number of Devices Collected: 1 


JSSCRET/ /NOFORN— 


HRC-874 


_SESRET/ /NOFORI- 
Title: (U) DEPARTMENT OF STATE : 


b3 per 


oe 


HRC-875 


b6 
bic 


HRC-876 


je & SECRET ALL FBI INFORMATION CONTAINED 
t ) @EREIN IS UNCLASSIFIED 


DATE 04-02-2019 BY CéswW46B11 NSICG 
UNCLASSIFIED/ /Feve— 


21 January 2016 
bé 


b7Cc 
MEMORANDUM FOR: 


Acting Section Chief 
Counterespionage Section 
Federal Bureau of Investigation 
b3 Per CIA 
Associate Deputy Director of Operations BIG: Hee: CTR. 
Central Intelligence Agency, 
Foreign Intelligence and Covert Action 


SUBJECT: (U/7FOUG+ MIDYEAR EXAM: 
Use Request - 5 January 2016 


(U/7FORS By Letterhead Memorandum dated 5 January 2016 bl Per CIA 
you requested CIA approval to use emails surfaced in the 3 Pers CIA 


referenced case with ae witnesses and their counsel. is) 
i 


(U//FO88} I am the Associate Deputy Director of Operations 
for CIA, Foreign Intelligence and Covert Action. The content of 
the emails, which was described to me, involve operational 
matters within my jurisdiction. As such, I have the authority 
to grant approval to use these emails as outlined in the 
referenced use request and release of this memorandum provides 
that approval with the following caveats: 


e FBI must verify that the witness/counsel: 

o had the appropriate clearance contemporaneously with 
the sending/receipt of the email at issue; 

© currently has the appropriate clearance when 
interviewed by the FBI; or 

o signs a Non-disclosure agreement at the time of the 
interview prior to being shown properly labeled CIA 
classified information. 


b3 Per CIA 
b6 Per CIA 
b7C Per CIA 


Attachment: Requested emails 


UNCLASSIFIED/ /EO86— : 
HRC-877 


[ t—(“(id RS RT = 


e @ 
UNCLASSIFIED/ Aeeue- 
ALL FBI INFORMATION CONTAINED 


HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318T80 NSICG 


U.S. Department of Justice 
Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


Date: S January 2016 b3 Per CIA 


. b6 Per CIA 
To: b7C Per CIA 
erespionage Group 


Counterintelligence Center CIA 
b6 


- b7C 
cting Section Chief 


Counterespionage Section 


Subject: Requests authority use classified CIA documents during 
interviews 


(U/7PO8O}+ In July 2015, the FBI received a Section 811 referral 
from the Inspector General for the Intelligence Community (ICIG) 
regarding the possible compromise of classified national security 
information. The potential compromise was identified when, as part of 
a Freedom of Information Act (FOIA) request, the U.S. Department of 
State (DoS) and the ICIG reviewed electronic mail (email 
communications from private email accounts previously used by a 
former Secretary of State during their tenure at Dos. 


(U/ APOUO)L At the request of the FBI, as well DoS and the ICIG, 
the CIA has since conducted classification reviews of emails and 
documents related to this matter that were deemed to contain CIA 
equities. 


(U/7FORE) Currently, the FBI plans to interview several 
individuals who originated, transmitted or received classified 
documents via an unclassified email system. During these interviews 
the FBI would like to show the interviewee, and if necessary their 
legal counsel, the relevant documents that they were a party to. 
Doing so will allow the FBI to pursue a logical line of questions 
regarding the circumstances in which the classified information was 


sent. 


UNCLASSIFIED/7Feve- 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 


to be distributed outside your agency. 
¢ = y ; HRC-878 


@ UNCLASSIFIED//EOUO @ bl Per CIA 
. b3 Per CIA 


x (3) 


(U//FOSG)_As such, the FBI respectfully requests Central 
Intelligence Agency (CIA) authority to show the above referenced 
emails to those individuals that were originally involved in each 
respective email chain. Given the amount of time that has, elapsed 


UNCLASSIFIED//Peve— 


This document contains neither recommendations nor conclusions of.the FBI. It is 
the property. of the FBI and.is loaned to your agency; it and its contents are not 


to be distributed outside your agency. SSGRET 


HRC-879 


SESREL 


@ UNCLASSIFIED//EOue e 


since the emails were first sent, the FBI believes that it is 
necessary to show the actual emails to the interviewees in order to 
have a meaningful discussion regarding the context in which the email 
was sent. For each listed email, the FBI will only show the email to 
individuals, and their attorneys, necessary to further the 
investigation. Additionally, standard safeguarding procedures will 
be used to ensure the protection of the content and to prevent any 
unnecessary disclosures. 


(U/ABB80T_Please direct all i iri ing this request to Be 


Sincer 


b6 
b7C 


Acting Section Chief 
Counterespionage Section 


o 


SECRET 


UNCLASSIFIED/Leoue- 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 


HRC-880 


Cans . i bie 
=a 
a : 


HRC-881 


ALL FBI INFORMATION CONTAINED 
e HEREIN IS UNCLASSIFIED 
DATE 04-02-2019 BY Cé6é6W46B11 NSICG 


UNCLASSIFIED//reve— 


MemoraNoUMFor:[ FEB 10 2016 a 


Acting Section Chief 
Counterespionage Section 
Federal Bureau of Investigation 


lr b3 Per CIA 

FROM: - b6 Per CIA 
Information Review Officer for the Director's Area b7C Per CIA 
SUBJECT: MIDYEAR EXAM: Use Request ~4 January 2016 
(U/AE@HOT By Letterhead Memorandum dated 4 January 2016 you requested CIA approval to 
use an email surfaced in the referenced case with two potential witnesses and their counsel. The email 
is unclassified, but for CIA Internal Use Only. 
b3 Per CIA 


(U/LEO¥ET | am the Information Review Officer for the Director's Area and have Original ie hase cen 
Classification Authority. As such, | have the authority to grant approval to use this email as outlined in b7C Per CIA 
the referenced use request and release of this memorandum provides that approval. 


Attachment: Requested email 


UNCLASSIFIED/ Bove 


HRC-882 


63 
es 2 


CK, a ape 
of 


HRC-883 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318T80 NSICG 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 2/12/2016 


b6 per DOS, FBI 
b7C per DOS, FBI 


On February 12, 2016, sAL________ electronically sent the Department of State (Dos) 
an LHM requesting authority to use DoS emails and do i interviews regarding the 


captioned matter. i nt t Executive Assistant, Bureau of 
Diplomatic Security. 


Copies of the requests are maintained in a 1A. 


Investigation on __2/12/2016 at Washington, DC b3 per FBI 


0 b7E per FBI 
b6 per FBI 
or ee 2 PIS Ree BBL 
This document contains neither recommendations nor conclusions of the FBI. It is the Property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


HRC-884 


b6 per 
b7C FBI 


HRC-894 


HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY J76J18T80 NSICG 


& -) 3 Bh . . ALL FBI INFORMATION CONTAINED 
LAW OFFICES 
WILLIAMS 8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 
WASHINGTON, D. C. 20005-5901 


DAVID E. KENDALL SOM AUL R CONNOLLY GOa2-1070) 
(202) 434-5145 4 (202) 434-5000 
dkendall@we.com 


FAX (202) 434-5029 


February 22, 2016 


E-MAIL 
b6 per 
USS. Department of Justice Rie FRE 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 


b6 per 
b7C FBI 
I write to memorialize our responses to two inquiries concerning the Department of 
Justice’s security inquiry. 


You asked that we identify the serial numbers for the Williams & Connolly LLP 
(“W&C”) laptops provided to the Federal Bureau of Investigation on August 6, 2015 and 
August 25, 2015, and to confirm the positions and number of W&C personnel who had access to 
those laptops during the time period that the laptops contained the .pst file of the e-mails that 
Secretary Clinton produced to the State Department. As listed on the property receipts for those 
laptops, the model and serial numbers are: (1) Lenovo Thinkpad T420, S/N PB-YC912 12/03; 
(2) Lenovo 4236-VQ5 S/N PB-YC910 12/03; and (3) Lenovo 4236-VQS5 S/N R8-NV8XB 11/11. 
Five W&C personnel (three attorneys, one paralegal, and one IT employee) had access to the 
laptops at points during the relevant time period. 


You asked whether Secretary Clinton’s @clintonemail.com e-mails for the time period 
January 21, 2009 through February 1, 2013 were transferred or migrated to the hrcoffice.com 
account. As we indicated, Secretary Clinton did not transfer her @clintonemail.com e-mails for 
the time period January 21, 2009 through February 1, 2013 to her @hrcoffice.com account, nor 
did she instruct anyone to do so. 


Sincerely, 


/| 2 a 


b3 per 
~\44 b7E FBI 


HRC-895 


bé per 
b7C FBI 


HRC-896 


HEREIN IS UNCLASSIFIED 


e@ Z . = ae ALL FBI INFORMATION CONTAINED 
DATE 11-10-2016 BY 376318T80 NSICG ~ 


LAW OFFICES 
WILLIAMS 8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 


SAVIOR KENDALL WASHINGTON, D. C. 20005-5901 rowan nnery wauians 20-003 
(202) 434-5145 (202) 434-5000 
dkendall@we. 
ite FAX (202) 434-5029 
February 22, 2016 
BY E-MAIL 


a B6 per 
“S. Department of Justice b7C FBI 


National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 
b7C FBI 
I write in response to your February 9, 2016 letter concerning certain equipment and 
devices. Following the inquiries that we have made in response to the requests in your letter, I 
can report the following. 


In relation to your request regarding “Desktop computer in Whitehaven residence: model 
unknown (located at residence as of July 2010),” we have identified an iMac G5, 20” iSight 
computer that is believed to have been housed at the Whitehaven residence during 2010. 

In relation to your request regarding an iPad “Generation 1 (Model A1337): Serial 
unknown (first use: June 2010),” we note that the iPad that we have previously identified to you, 
and which will be voluntarily produced pursuant to a consent letter is a Model A1337. 


We have not located any equipment or devices matching the descriptions of the 
remaining items in your letter. 


‘Si incerely. 


F beh 


David 'E. Kendall 


HRC-897 


b3 per 
(sd pines 


b6 per 
b7C EB: 


HRC-898 


I 


ALL FBI INFORMATION CONTAINED 
wen pe oe ee ae "HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY J76318TS0 NSICC 


LAW OFFICES 


WILLIAMS 8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 


DAVID E KENDALL WASHINGTON, D. C. 20005-5901 BDRARD MENNETT WILLIAMS 1020-1000) 


(202) 434-5145 (202) 434-5000 
dkendall@we.com FAX (202) 434-5029 


February 23, 2016 


BY E-MAIL 


U.S. Department of Justice 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 


beef] 


This letter provides consent, in connection with the Department of Justice’s security 
inquiry and subject to the provisions set forth herein, (1) to search the iPad, Model A1337 
(hereinafter “the device”) provided to the Federal Bureau of Investigation (FBI) for Secretary 
Clinton’s e-mails and files dated January 21, 2009 to February 1, 2013; and (2) to conduct a 
forensic analysis of the device for the purpose of identifying information relevant to the 
Department of Justice’s security inquiry. This consent applies solely to the above-described e- 
mails and files of Secretary Clinton, and not to any of her e-mails and files outside of the date 
range or to the e-mails or files of any other individuals that reside on the device. 


You have confirmed that any searches of the device will be undertaken initially by a filter 
team, who will hold back from the investigative team any e-mails or files that may contain 
privileged information. You have further confirmed that the filter team will set aside any e-mails 
or files (including Contacts) that are associated with the @hrcoffice.com domain account or 
created after February 1, 2013; and that any e-mails or files associated with that domain account 
or created after February 1, 2013 will not be searched or reviewed by anyone, even by the filter 
team, or otherwise be used in connection with your security. inquiry or for any other purpose, as 
those e-mails arid files were not in existence during the relevant time period. In order to preserve 
the data on the device, we agreed, as of December 23, 2015, not to tum on the device or to 
otherwise modify the device prior to its production to the FBI. 


In connection, with the filter team’s efforts to segregate from the investigative team any e- 
mails or files that may contain privileged information, I incorporate by reference my October 1, 
2015 letter, which provides a list of individuals and entities with whom Secretary Clinton may 
have communicated in a privileged context, and my October 16, 2015 e-mail, which 
supplemented that list. | 


WILLIAMS 8 CONNOLLY LLP 
b6 per 


b7C FBI 
February 23, 2016 


Page 2 


We request and anticipate that the device, as well as any of Secretary Clinton’s non- 
federal record e-mails or files on the device, will be returned to us at the conclusion of your 
inquiry. . 


Sincerely, 


é ke 


David E. Kendall 


HRC-900 


b6 per 
b7C FBI 


HRC-901 


ALL FBI INFORMATION CONTAINED 
e@ HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318TS0 NSICG 
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-1- 
FEDERAL BUREAU OF INVESTIGATION b3 Per CIA 
b6 Per FBI, CIA 
b7C Per FBI 


Date of transcription _ 2/24/2016 


FBI liaison to the Counterespionage Group Counterintelligence Center, Central Intelligence 
Agency (CIA), with an LHM requesting assistance in contacting former CIA Deputy Director Michael 
Morell for an interview. The LHM was provided t via the FBI Microsoft Lync system. 


cy February 24, at approximately 3:50 PM, Special Agent|________ provide] 


A copy of the LHM is enclosed in an accompanying 1A. 


b3 per FBI 
Investigation on__2/24/2016 at____ Washington, DC b7E per FBI 
Fie [Od KT Date dictated___N/A 

bé per FBI 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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@ ALL FBI INFORMATION CONTAINED 
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FD-302a (Rev. 10-6-95) 
A 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 2/24/2016 
b3 per CIA 


b6 per FBI, CIA 
b7C per FBI 


On February 24, 2016, ja the Central Intelligence Agency (CIA) 
with an LHM to give notice that the FBI planned to use documents possibl; ini ified CIA 
equities during future interviews. The LHM was provided to CIA detaillee 


A copy of the LHM is enclosed in an attached 1A. 


b3 per FBI 


b7E per FBI 


Investigation on __2/24/2016 at Washington, DC 


File# [ —sdr ~'1'¥8 Date dictated ___N/A 


b6 per FBI 
ByS. b7c per FBI 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED February 26, 2016 


TO: FBI — Peter Strzok 
FROM: DS - Gregory B. AKO a 


SUBJECT: Request for Authority to use Classified Department of State 
Documents During Interviews 


Thank you for your letter of February 12, 2016 regarding the FBI’s request 
for authority to show classified Department of State e-mails and documents during 
interviews. We have received by e-mail a list of 74 individuals whom the FBI may 
want to interview regarding these documents. 


The Department of State understands the FBI’s desire to use these 
documents in interviews to pursue logical lines of questioning pursuant to your 
investigation, and similarly understands the desire to share these documents with 
both interviewees and their legal counsel if necessary. However, we are 
particularly concerned about sharing the 22 e-mails determined by the Intelligence 
Community (IC) to contain Top Secret (TS) information. The Department poses 
no objection to the FBI’s plan to use the documents during interviews, but the 
Department believes that any individual, to include legal counsel, with whom these 
e-mails will be shared must have appropriate security clearances and must be read 
in to any special access program discussed in the relevant e-mail by the 
Department of State’s Bureau of Intelligence and Research or by the appropriate 
IC element. 


The Department has independently identified the recipients of the 22 TS e- 
mails for the purposes of placing the documents under proper controls and 
performing any necessary inadvertent disclosure procedures (the number of 
contemporaneous recipients is a small fraction of the list provided to the 
Department by the FBI). We have also compiled and can provide information on 
which recipients were cleared for access to the information at the time the e-mails 
were sent and which recipients are cleared for such access now. In addition, we 
can provide their current employment status and the status of their security 
clearance. We can provide the same information for those individuals on the FBI’s 


UNCLASSIFIED HRC-906 


b3 per 


es | "7 sas 


UNCLASSIFIED 
a%- 

list who did not have access to the e-mails determined by the IC to contain TS 
information. With respect to individuals not currently employed by the 
Department of State, the Department defers to the FBI to determine whether they 
may be granted a TS security clearance and have the necessary need to know for 
purposes of granting access to the information contained within the e-mails. If the 
FBI makes an affirmative determination, the Department has no objection to the e- 
mails being shown to the interviewees and their legal counsel. 


Should you wish the Department of State to provide the information above, I 


request the FBI inform the Department of State in writing. We will then provide 
the requested information through our previously established channels. 


Attachment: 
Tab — FBI Letter dated February 12, 2016 


UNCLASSIFIED 


HRC-907 


Approved: DS — Gregory B. Starr 
oe be sore, rs 
b7C per DOS, FBI 


Cleared: _M-— PKennedy (ok) 


L- (ok) 
INR (ok) 
INR (ok) 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


“SENSITIVE BUT UNCLASSIFIED March 1, 2016 


MEMORANDUM FOR RECORD TO THE FEDERAL BUREAU OF 
INVESTIGATION : 


FROM: DS -Gregory B. san {oe y= 
SUBJECT: State’s Compliance Regarding FBI Requests 


(U) I am writing to follow up on our January 29" video teleconference and 
our February 1* meeting regarding the Department of State’s response to the FBI 
investigation of Secretary of State Hillary R. Clinton’s emails. 


(SBY) In our discussions on the production of records, the Department of 
State previously outlined current IT data management. As we have said, technical 
limitations affect our ability to achieve full compliance with the Bureau’s request. 
We remain committed to working with the FBI investigative team to refine the 
request to ensure the most compliant response possible. 


(U) My staff, with principal point of contact] can work with she ae 
FBI personnel and offices from State to determine how or if we can bebest | 
responsive. 


Attachment: 
Tab — DOS IT Technical Limitations 


HRC-910 
SENSHFVE BUT UNCLASSIFIED 


, b3 per 
-1Se b7E FBI 


Approved: S/ES — Joe Macmanus ( OK ) 


Drafted: 


Cleared: 


psf 


IRM ) 
INR (OK) 
A/GIS — Peggy Grafeld ( OK ) 
S/ES-IRM[{____(OK) 


b6 per DOS, FBI 
b7C per DOS, FBI 
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Department of State IT Technical Limitations 


This paper outlines technical limitations of the Department of State’s IT 
infrastructure as related to the FBI investigation into Secretary of State Hillary R. 
Clinton’s emails. 


Limitations Due to Organization and Infrastructure 
(U) The Department of State (DOS) is committed to a thorough and timely 


response to the multiple data production requests from the Federal Bureau of 
Investigation (FBI). However, as previously noted, technical limitations affect this 
outcome. The Department’s use of multiple networks, multiple administrative 
entities, and multiple policies governing the storage, retention, and disposition of 
documents and e-mails created over the time period outlined in the FBI’s requests 
are the chief obstacle in our efforts to comply. In addition, until 2009 the 
Department’s email retention policy relied on individual employees to print and 
file the emails the individual employee judged to be a record. Beginning in 2009, 
while “print and file” remained the official general guidance of the Department, the 
Department nevertheless captured the inboxes of certain senior officials on their 
departure. Again, as previously described, this capture would include all emails 
still residing in their email inbox but would not include any emails they had 
previously deleted. 


The Disparate Nature of Networks Create Challenges 
4SBU) Data requested by the FBI potentially resides on four different 


physical networks: OpenNet (unclassified up to SBU), PACE (unclassified for 
Public Affairs), ClassNet (up to Secret), and a TS/SCI information system operated 
by the Bureau of Intelligence and Research (INR). The Department does not 
maintain a single data owner or custodian for the OpenNet and ClassNet systems. 
Rather the data custodians, data owners, and official archivists vary according to 
which information resource management office supports the employee’s bureau. 
Consequently, multiple offices may need to take action in response to the data 
production requests, depending on the assignment history of the employee in 
question. On these two networks, the IRM Bureau is the largest data custodian, 
managing approximately 25% of mailboxes, primarily for users located in the 
Washington DC region. Mailboxes for these users are limited to SGB and users 
routinely use Personal Archives (.pst files) to store older e-mail that exceeds this 
storage location. These .pst files are stored in multiple locations by users, including 
home directories, other network shares, local workstations, and sometimes on 
removable media. As a result, IRM can only fully verify content of “active” 
mailboxes - anything archived in a .pst file may or may not be discovered. The 


-SENSEFEVE BUT UNCLASSIFIED 
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data owner of these IRM-managed mailboxes is the bureau to which the employee 
is assigned. When the employee departs the Department, the data owner is 
responsible to determine the disposition of the mailbox and other user-created files. 
The data owner has the ability to retain the files within the bureau or transfer them 
to the A Bureau for official archiving. Regardless of the decision, the e-mail and 
files are removed from the on-line system six months after the employee leaves the 
Department. After this time, IRM can no longer access and provide the data. 


{SBU) The Secretary, other Department Principals, certain Special Envoys, 
their staffs, and the Executive Secretariat (S/ES) use OpenNet and ClassNet 
accounts in a system called the Principal Officers’ Executive Management 
Support, or POEMS. The Executive Secretariat manages POEMS through its IT 
office, S/ES-IRM. When an official leaves the Department, S/ES-IRM, in 
coordination with record-keeping officials in S/ES and staff from the official’s 
office, creates one or more .pst files containing the departing official’s email, and 
saves all material stored on the official’s personal drive, or P drive, to the same 
.pst. That data is backed up and kept indefinitely. S/ES-IRM performed this 
procedure for several prior administrations. While comprehensive in capturing all 
extant emails, this process did not, however, preserve emails previously deleted by 
the official. 


(U) For overseas users and for domestic locations including the U.S. Mission 
to the UN, the Department’s administrative center in Charleston, SC, the offices of 
the Inspector General, and U.S. passport offices, the data custodian and owner are 
the U.S. embassy or consulate where the employee works, or domestic office itself. 


(U) Many Department employees including Foreign Service regularly rotate 
assignments from domestic to foreign assignments and between different locations 
in the Department. Department administrative restrictions place limits on the total 

- bandwidth available for the storage of an individual employee’s email and other 
data. Employees must therefore reduce their total on-line data storage prior to 
departure. In this way, they may enable the transfer of their data over the OpenNet 
and ClassNet networks from the office they are departing and to the office or 
mission abroad where they will arrive. 


(U) Furthermore data transfer is also limited by policy. The Foreign Affairs 
Manual states, “Department workforce members must not take official files with 
them when they are reassigned to the field from the Department, to the Department 
from the field, or between posts unless the records transfer has been approved by 
A/GIS/IPS/RA.” (5 FAM 432.4) As a result, finding specifically requested data 
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for individuals who have rotated assignments since the date the item was created is 
especially difficult. 


INR Network 
(SBU) The Department’s TS/SCI network is the most straightforward, 


particularly with respect to email, because there is only one data custodian (INR) 
for email sent on that network (sometimes referred to as “ice-mail” because it 
resolves to @state.ic.gov email addresses). Pursuant to Intelligence Community 
(IC) guidance, INR saves electronic records for 25 years. Since early 2014 it has 
backed records up to disk in addition to less reliable tapes, which previously were 
used exclusively. Also, in November 2014 INR installed CommVault Indexer. 
INR is now able to search electronic records, including ICEmail, relatively easily. 
For periods predating early 2014, however, restoration of email accounts may be 
difficult or, in the case of certain older accounts, impracticable if not impossible. 


(SBY) Department users with ice-mail accounts fall into two categories: 
those who have “INRISS” (INR Information Support System) accounts and those 
with “elntel” accounts, which were first introduced to the Department by INR in 
2008. During 2009-2013, INR maintained two mail servers, one for INRISS 
account holders and another for elntel account holders. In early 2014 INR began 
transitioning elntel users to the INRISS mail server. In the process of migration, 
only active accounts were migrated. If at the time it was reached in the migration 
process an account had not been logged into within the prior 365 days it was 
deemed inactive and retired; its mailbox contents were saved into a PST file and 
stored on a file server that was decommissioned in late 2014. That server is still 
available, and the PST files on this server can be accessed, but the PST files 
represent the user’s mailbox as it existed the day the account was retired. To 
determine what the account looked like prior to its retirement INR must turn to the 
former elntel mail server’s tape backups, which are old and rely on infrastructure 
that is no longer in operation. 


{SBW With respect to the ICEmail accounts requested by the FBI, all were 
elntel accounts and were inactive at the time of the 2014 migration mentioned 
above. With one exception, the associated PST files that were saved and stored 
contained no data, indicating a mailbox that was empty at the time of the 
migration. The one PST file that was not empty was copied and provided to the 
FBI. 


SENSITIVE BUT UNCLASSIFIED 


-SENSEPPVE BUT UNCLASSIFIED 


Detail Specific Search Requests Yield Better Results 

(U) The Department of State’s current search technology does not allow cross- 
enclave searches. Most Department email data searches are done using relatively 
simple Outlook search tools, i.e. keyword searches of specific .psts or email boxes. 
Such searches are based within specific selected employees’ records. It is 
therefore not possible to conduct a search in response to vague or general requests 
that specify “all e-mail to or from” or “all e-mail related to” a particular topic. 
Even within one of the above systems, there is no comprehensive search method 
that can even attempt such a search, much less provide accurate results. Instead 
requests should specify the employees’ electronic records to be searched, 
timeframes, and relevant keywords. For example, “all e-mail between users x and 
y regarding (topic keywords)” or “all e-mail related to w either sent or received by 
users x,y, and z between xxx date and yyy date” will have a much greater chance of 
yielding responsive records, assuming those employees’ records are available. 


‘SENSHFHVE BUT UNCLASSIFIED 
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U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 
File No. 


March 8, 2016 


Gregory B. Starr 

Assistant Secretary of State for Diplomatic Security 
U.S. Department of State 

2201 C Street, NW 

Washington, DC 20520 


Dear Mr. Starr: 


I am writing in response to your letter dated February 8, 2016 regarding the Department 
of State’s Freedom of Information Act (FOIA) review of former Secretary of State Hillary 
Clinton’s emails. We appreciate your concerns about the impact that the Department of State 
(DOS) actions may have on our ongoing investigation. Consistent with DOS’s normal practice, 
as described in your letter, DOS should hold in abeyance any administrative action related to the 
mishandling of classified information for a limited and reasonable amount of time until the FBI 
can determine what, if any, impact such action might have on our investigation. 


As for the emails that have been classified by the US Intelligence Community or DOS, 
the FBI recommends that you follow the standard security procedures established by DOS to 
remove potentially classified materials from any unclassified network. 


Finally, with regard to Congressional requests for copies of the former Secretary’s 
classified emails, the FBI defers to DOS to respond consistent with its normal practices, 


Sincerely, 
E00. TK 


E.W. Priestap 
Assistant Director 


HRC-920 
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UNCLASSIFIED/ FOUC- DATE 04-02-2015 BY Cé6w46B11 NSICG 


Central Intelligence Agency 


‘Washirigton; D.C. 20505 


MAR 0 1 2016 


b6 per FBI 
b7C per FBI 
MEMORANDUM FOR: Director € 
Federal Bureau of Investigation me 
NUNES 
ATTENTION: Peter P. Strzok \: 
Section Chief, CD-4 9 
Counterintelligence Division 
SUBJECT: (U//2e80} MIDYEAR EXAM - Response to LHM Cc 
[ib 
REFERENCE: (U//BE8O) FBI LHM, dtd 24 Feb 2016 ap 


aie (U//BO8OT Action Requested: For your information and 


i Please forward to Special agent[ | 
b6 per FBI 


b7C per FBI 
2. (U/Leoue; The following information is provided for 


the exclusive use of your organization for background, 
investigative, or lead purposes, as appropriate. It may not be 
used in any legal proceeding without prior coordination. While 
the information may be shared with necessary investigative 
components of your organization, it should not be released in 
any form to other components within the CIA or any other 
agencies without prior approval of 


Counterintelligence Mission Center, b3 Per CIA 
Counterespionage Group (c/cimc[__|/cEG) . Details contained in 

this CIOL may not be uploaded into any SIPRNET-based computer 

system. 


CIOL-0183-16 
HRC-922 
UNCLASSIFIED/ /PeU0 
b3 per FBI 


UNCLASSIFIED/ /O8e @ 


SUBJECT: (U//e80} MIDYEAR EXAM — Response to LHM 


3. (U//ee80}) This CIOL responds to your LHM dated 
24 February 2016 in which you asked for CIA assistance in 
arranging an FBI interview of former DDCIA Michael Morell on a 
voluntary basis. FBI detailee to CIMC/CEG further explained 
that FBI is seeking this interview because of Mr. Morell’s 
subject matter expertise; he is not the target or subject of the 
underlying sensitive matter. Mr. Morell requests that his 
attorney, Ken Wainstein, be present at the interview; 
Mr. Wainstein is unable to meet on 4 March 2016. Mr. Morell 
indicated that Mr. Wainstein can be reached at (202) 862-2474 to 
schedule a meeting. 


4. (U//PeU0) Please address all correspondence concerning 
this matter to the Counterintelligence Mission Center b3 Per CIA 
Counterespionage Group, Attention: b6 Per CIA 


commercial line referencing the CIOL number byG: Per/CIM 


given below. 
FOR THE ASSISTANT DIRECTOR/CIA FOR COUNTERINTELLIGENCE: 


b3 Per CIA 
b6 Per CIA 
b7C Per CIA 


CIOL-0183-16 


CIOL-0183-16 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED March 21, 2016 
TO: FBI - E.W. Priestap 


FROM: DS - Gregory B. S Rane 


SUBJECT: Congressional Review of Hillary Clinton E-mails Classified Secret or 


Confidential 


Thank you for your letter of March 8, 2016 (Tab 1), which contained helpful 
guidance. As a follow-up, I am writing to inform you that the Department of State 
intends to make available, with limited redactions, versions of the Hillary Clinton 
e-mails classified as Secret or Confidential during the Freedom of Information Act 
review process, to appropriately cleared members and staff of the Senate Foreign 
Relations Committee (SFRC) possibly starting as early as this week. The e-mails 
may be shared with additional committees in the future. The e-mails will be 
available for review, either in-camera or at the State Department, but will not be 
retained by the reviewers. In addition, reviewers will not be permitted to make 
copies or otherwise reproduce the contents of the e-mails during their scheduled 
review. 


The 22 e-mails determined by the IC to contain Top Secret information will 
not be made available to the SFRC. 


Attachments: ; 
Tab 1 — FBI letter dated March 8, 2016 
Tab 2 — Department of State letter dated February 8, 2016 


UNCLASSIFIED nG-o05" 


b3 per 


Drafted: 


Cleared: 


M- (ok) 
L- (ok) 
LAW/DS - (ok) 
INR - (ok) 
A/GIS - (ok) 
H- (ok) 
 DS/Leg- (ok) 
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U.S. Department of Justice 


Federal Bureau of Investigation 


_ In Reply, Please Refer to 
File No. 


March 8, 2016 


Gregory B. Starr 

Assistant Secretary of State for Diplomatic Security 
U.S. Department of State 

2201 C Street, NW 

Washington, DC 20520 


Dear Mr. Starr: 


I am writing in response to your letter dated February 8, 2016 regarding the Department 
of State’s Freedom of Information Act (FOIA) review of former Secretary of State Hillary 
Clinton’s emails. We appreciate your concerns about the impact that the Department of State 
(DOS) actions may have on our ongoing investigation. Consistent with DOS’s normal practice, 
as described in your letter, DOS should hold in abeyance any administrative action related to the 
mishandling of classified information for a limited and reasonable amount of time until the FBI 
can determine what, if any, impact such action might have on our investigation. 


As for the emails that have been classified by the US Intelligence Community or DOS, ° 
the FBI recommends that you follow the standard security procedures established by DOS to 
remove potentially classified materials from any unclassified network. 


Finally, with regard to Congressional requests for copies of the former Secretary’s 
classified emails, the FBI defers to DOS to respond consistent with its normal practices, 


Sincerely, 


£0. Px 


E.W. Priestap 
Assistant Director 


HRC-92 
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United States Department of State 


Assistant Secretary of State 
Sor Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED February 8, 2016 
TO: FBI - E.W. Priestap 

FROM: DS - Gregory B. S ee a 
SUBJECT: Department of State Hillary Clinton E-mail Review 


1 am writing to follow up on our January 29, 2016 video teleconference 
regarding the current status of the Department of State’s Freedom of Information 
Act (FOIA) reviews of former Secretary of State Hillary R. Clinton’s e-mails. 


Late last week the Department reported that 22 Clinton e-mails would not be 
publically released due to their Top Secret (TS) classification at the request of the 
Intelligence Community (IC). That is, under FOIA, these e-mails were denied in 
full, but they are being accounted for in the Clinton e-mail collection. In addition 
to these 22 TS e-mails, portions of 22 other e-mails have been classified Secret by 
the State Department or the IC to date. Finally, approximately 1300 e-mails 
contain sensitive information that was previously redacted and classified as 
Confidential prior to the e-mails’ release under our FOIA process. 


The Department of State is prepared to take appropriate administrative 
action for any instances of mishandling of classified information in accordance 
with our own internal processes (see Attachment). However, we appreciate the 
sensitivity of ongoing criminal investigations generally and do not want to 
compromise or hinder the FBI’s current investigation in any way. It has been the 
normal practice of the Department and the Bureau of Diplomatic Security to delay 
taking administrative action against current State employees when active criminal 
investigations of a parallel nature are underway. | request the Department of 
Justice (DOJ) and FBI inform the Department of State in writing as soon as 
possible if the Department of State can undertake administrative investigations or 
inquiries into possible security violations, or if the Department of State should 
delay due to the current criminal investigation until notification to proceed is 
received from the DOJ and FBI. 


HRC-928 


In addition, following up on my letter of September 15, 2015, please be 
advised that pending further guidance from the FBI we are still — as a general rule 
— not removing any emails that have since been classified from any unclassified 
systems or providing instruction to individuals that may have upgraded classified 
emails on non-official email accounts to take steps to protect this information. 


Finally, Congressional Committees have requested unredacted copies of 
former Secretary Clinton’s classified e-mails. I request DOJ and FBI inform the 
Department of State in writing as soon as possible as to whether they have any 
concerns regarding such a possible production of these e-mails in unredacted form 
at this juncture. I note that we are not considering turning over to any Committee 
documents the members/staff are not cleared to receive because of their 
classification level. 


Attachment: 
Tab — 12 FAM 550 Security Incident Program 


HRC-929 


Approved: DS -— Gregory B. Starr 

° b6 per DOS, FBI 
Drafted: Ds{ bic per DOS, FBI 
Cleared: Lf | (ok) 
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Sror2e77 Averorn— 


FEDERAL BUREAU OF INVESTIGATION 
Collected Item Log 
(0) 
Event Title: Yet Collect from DoS under Date: 04/06/2016 
banner/FOIA authority 


b6 per FBI 
Approved By: b7C per FBI 
brated By:[ 
. FBI 
case 20 42d) Dre ven sen Sie poe FE 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Full Investigation Initiated: 07/10/2015 


cottected From: [1] be per DOs 
epartment of State per 


Receipt Given?: No 
Holding Office: . WASHINGTON FIELD 
Details: No Details Provided 


Item Type Description b6 per DOS, FBI 
1B Digital {) RS pvp containing PST for | b7C per DOS, FBI 

Collected On: 04/06 

Seizing Individual: 

Collected By: 

Location Area: 

Specific Location: N/A 

Device Type: Compact Disc/Digital Video 

Disc (CDs/DVDs) 

Number of Devices Collected: 1 


SECRET HroFoRN- 


This document contains neither recommendations nor conclusions of the FBI. Itis the property of the FBI and is loaned to your agency; it and its 
contents are not to be distributed outside your agency. 


HRC-932 


0) SBECRET//Norenn— 
Title: @§ collect from DoS under banner/FOIA authority 


b3 per 
3 2 
Re Pia a] 4/06/2016 b7E FBI 


o 


HRC-933 


CEE 


L 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


Date: March 18, 2016 
€ b3 Per CIA 
To: b6 Per CIA 
Counterespionage Group b7C Per CIA 


Counterintelligence Center CIA 
4 


From: Peter P. Strzok 
Section Chief 
Counterespionage Section 


? 


Subject: Request for Identification 


DS/ Beer The FBI Washington Field Office (WFO) respectfully 
requests the CIA’s assistance in identifying the names and current 
location of the individuals who occupied the positions listed below 
during the date ranges provided. This assistance is in regards to 


requests for FBI interviews. These interviews are voluntary and 

pertain to a sensitive matter in which the FBI believes the 

individuals may be of assistance. bl Per CIA 
b3 Per CIA 


2011 - September 2012 (3) 


e May 2011. - 
eptember . 

° May 2011 - September 2012 ; 

° May~2011°= september ~~ (4) 


° Di i — 2012 
2010---2012 (8) 


‘SEDRET/ 7Norern— 
This document contains neither recommendations nor conclusions of the FBI. It is 


the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 


’ HRC-937 


TBpseer7 AereRN- 


(U/ -Pete> If you have any questions regarding this request, 
please dizest all ingviries to Speciai agent{ sd at 


+ 


Sincerely, 


Peter P. Strzok 
Section Chief 
Counterespionage Section 


DS a 


This document contains neither recommendations nor conclusions of the FBI. 


b6 per 
b7C FBI 


It is 


the property of the FBI and is loaned to your agency; it and its contents are not 


to be distributed outside your agency. 


HRC-938 


ie JBECRET 8 
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b7E FBI 


HRC-939 


ALL FBI INFORMATION CONTAINED 
@ HEREIN IS UNCLASSIFIED 
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b3 Per CIA 


Central Intelligence Agency 


Washington, D.C. 20505 


APR O7 2016 


MEMORANDUM FOR: Director 
Federal Bureau of Investigation 


ATTENTION: Peter P. Strzok, II 
Section Chief, CD-4 
Counterintelligence Division 


SUBJECT: {U} $/ ANP} MIDYEAR EXAM - Response to LHM 


REFERENCE: (U//Pese+ FBI LHM, dtd 16 March 2016 


1. (U/APO86}+ Action Requested: For your information and 


action, as appropriate. Please forward to Special aAgentL ids b6 per 
] b7C FBI 


2. (U//Fe8e} The following information is provided for 
the exclusive use of your organization for background, 
investigative, or lead purposes, as appropriate. It may not be 
used in any legal proceeding without prior coordination. While 
the information may be shared with necessary investigative 


CIOL-0254-16 b3 Per CIA 


sseret/[" frorer 


HRC-940 


@ emf prove © bo Por crn 


(0) -supgectT:(ng/ ANE} MIDYEAR EXAM - Response to LHM 


components of your organization, it should not be released in 
any form to other components within the CIA or any other 
agencies without prior approval of the Chief 


Counterintelligence Mission Center b3 Per CIA 
Counterespionage Group (C/CIMC/ CEG). Details contained in 
this CIOL may not be uploaded into any SIPRNET-based computer 
system. 
bl Per CIA 
3. ps/I-)} 0pPer the referenced FBI Letterhead b3 Per CIA 
b6 Per CIA 


Memorandum (LHM) dated 16 March 2016, CIA provides the attached 
spreadsheet 


CIOL-0254-16 


-seexzt7[___Prorerte b3 Per CIA 


HRC-941 


@ eeent7[_—__ frerorn e Pevhee Cie 


{ bl P cIA 
0) supsEcT:  [e¢//¥F} MIDYEAR EXAM - Response to LHM a pence 
b6 Per CIA 
(8) 

5. (U/#PO8e} Please address all correspondence concerning 


this matter to the Counterintelligence Mission Center, b3 Per CIA 
Counterespionage Group, Attention: 
commercial line referencing the CIOL number 


given below. 


FOR THE ASSISTANT DIRECTOR/CIA FOR COUNTERINTELLIGENCE: 


b3 Per CIA 
b6 Per CIA 
CIOL-0254-16 
bl Per CIA 
Attachment: (S/AtP- (g) b3 Per CIA 
\ 


CIOL-0254-16 
| 


‘sesner/[_frorons pS Pex: CIA 
HRC-942 


- 162 b3 
Vio S[>/(e b7C per 


HRC-959 


« 


@ ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY J76318TS0 NSICG 
LAW OFFICES 


WILLIAMS & CONNOLLY LLP 
725 TWELFTH STREET, N.W. 


SAVID E:RENDALL WASHINGTON, D. C. 20005-5901 town So WIAs (020-1060 
(202) 434-5145 (202) 434-5000 
senna FAX (202) 434-5029 
April 15, 2016 
BY E-MAIL 


U.S. Department of Justice 
National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 


b7c FBI 


This letter provides consent, in connection with the Department of Justice’s security 
inquiry and subject to the provisions set forth herein, to conduct a preliminary examination of the 
iPad mini, Model A1432 (hereinafter “the device”) provided to the Federal Bureau of 
Investigation (FBI), for the limited purposes of (1) determining whether any of Secretary 
Clinton’s e-mails and files dated January 21, 2009 to February 1, 2013 reside on the device; and 
(2) conducting an analysis of the device to determine whether any intrusions occurred. You have 
represented to us that the intrusion analysis will not involve search or review of any e-mails or 
files that reside on the device. Furthermore, to the extent the FBI determines in that preliminary 
examination that no e-mails or files of Secretary Clinton dated January 21, 2009 to February 1, 
2013 reside on the device, you have agreed to return the device to us promptly without 
conducting any further examination of the device other than the intrusion analysis. 


To the extent the FBI determines in its preliminary examination that e-mails or files of 
Secretary Clinton dated January 21, 2009 to February 1, 2013 do reside on the device, this letter 
provides consent, in connection with the Department of Justice’s security inquiry and subject to 
the provisions set forth herein, to search such e-mails and files of Secretary Clinton dated 
January 21, 2009 to February 1, 2013 (in accordance with the procedures outlined below) for the 
purpose of identifying information relevant to the Department of Justice’s security inquiry. This 
consent applies solely to the above-described e-mails and files of Secretary Clinton (to the extent 
any such files exist on the device), and not to any of her e-mails and files outside of the date 
range or to the e-mails or files of any other individuals that may reside on the device. 


HRC-960 


m 


WILLIAMS 8 CONNOLLY LLP 


Apiil 15, 2016 Pee 


Page 2 


You have confirmed that the searches consented to above will be undertaken first by a 
filter team, who will hold back from the investigative team any e-mails or files that may contain 
privileged information, as well as all e-mails and files outside of the scope of the searches 
consented to above. You have further confirmed that the filter team will set aside any e-mails or 
files (including Contacts) that are associated with the @hrcoffice.com domain account or were 
created after February 1, 2013; and that any e-mails or files associated with that domain account 
or created after February 1, 2013 will not be searched or reviewed by anyone, even by the filter 
team, or otherwise be used in connection with your security inquiry or for any other purpose, as 
those e-mails and files were not in existence during the relevant time period. 


In connection with the filter team’s efforts to segregate from the investigative team any e- 
mails or files that may contain privileged information, I incorporate by reference my October 1, 
2015 letter, which provides a list of individuals and entities with whom Secretary Clinton may 
have communicated in a privileged context, and my October 16, 2015 e-mail, which 
supplemented that list. 


In the event that the device is determined in the FBI’s preliminary examination to contain 
e-mails or files of Secretary Clinton dated January 21, 2009 to February 1, 2013, we request and 
anticipate that the device, as well as any of Secretary Clinton’s non-federal record e-mails or 
files on the device, will be returned to us at the conclusion of your inquiry. 


Z 


9; 
David E. Kendall 


Sincerely, 


-HRC-961 


b3 
b6 
b7c per 
b7E FBI 


HRC-962 


HEREIN IS UNCLASSIFIED 


e ¢ nGenee ‘v ALL FBI INFORMATION CONTAINED i ae Sieh ee 
DATE 11-10-2016 BY J76318T80 NSICG 


LAW OFFICES 


WILLIAMS 8 CONNOLLY LLP 
725 TWELFTH STREET, N.W. 
» WASHINGTON, D. C. 20005-5901 EDWARD BENNETT WILLIAMS 0920-1908) 


PAUL R_ CONNOLLY (1922-1978) 


DAVID E. KENDALL 
(202) 434-5145 : (202) 434-5000 


dk : 
sntal@yc- cmt FAX (202) 434-5029 


April 22, 2016 


BY E-MAIL 


b6 per 
4 b7C FBI 
"S. Department of Justice 


National Security Division 
950 Pennsylvania Avenue NW 
Washington, DC 20530 


b6 per 
This letter confirms that, pursuant to our discussions, Williams & Connolly LLP 
(“W&C”) has provided to the Department of Justice two W&C hard drives (a Samsung Lenovo 
256 GB hard drive and a Samsung Lenovo 128 GB hard drive) (the “drives”) for the sole 
purpose of destruction. The drives each contained a copy of data that W&C had previously 
provided to the Department of Justice, as well as other W&C attorney-client privileged and 
attorney work product materials. Pursuant to our agreement, W&C has deleted all data from the 
drives prior to providing them to the Department. We understand that once the drives have been 
destroyed, you will provide us confirmation of that fact. For avoidance of doubt, this letter does 
not provide any consent to search the drives prior to their destruction. 


2 


David E. Kendall 


Sincerely, 


HRC-963 ~ 


b6 per 
b7C FBI 


HRC-975 


~ 


t 


; ALL FBI INFORMATION CONTAINED 
@ HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318T80 NSICG 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


David E, Kendall, Esq. 
Katherine M. Turner, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


February 9, 2016 


Dear Mr. Kendall and Ms. Turner, 
b5 per NSD 


1. Laptop Computer 


© MacBook Air: Serial unknown (purchased November 2008) 


2. Desktop Computer 


¢ Desktop computer in Whitehaven residence: model unknown (located at residence as of July 
2010) 


3. Pads 
¢ Generation 1 (Model A1337): Serial unknown (first use: June 2010) 
¢ Generation 3: Serial DLXHFT7VDVGI (first use: May 2012) 
© = Mini: Serial unknown 


4, Phones Associated with (212) 920-6329 


¢ BlackBerry Curve 8310: IMEI 359315014408230 (January 2009 — May 2009) 

BlackBerry Curve 8900: IMEI 359485022135651 (June 2009 — September 2009) 

BlackBerry Curve 8900; IMEI 358453025219261 (September 2009 — August 2011) 

BlackBerry Curve 8900: IMEI 358453029684668 (August 201 1 — February 2012) | 

BlackBerry Curve 8900: IMEI 355383038220886 (February 2012) 

BlackBerry Bold 9900: IMEI 357966040796790 (February 2012) 

BlackBerry Curve 8900: IMEI 355383039952164 (February 2012 — March 2012) 

BlackBerry Curve 9360; IMEI 3579650401 12701 (February 2012 — March 2013) 

BlackBerry Curve 9360: IMEI 357965043386724 (March 2013 — October 2013) i 
| 
i 
i 


eoeceoeree 


HRC-976 


b3 per 


© BlackBerry Bold 9900: IMEI 357966044557578 (October 2013 — November 2015) 
© BlackBerry Bold 9900: IMEI 3579660448693 12 (December 2014) 


5. Phones Associated with (212) 920-7127 
© Sony Xperia Z C6603: IMEI 35576205415155 (April 2013) 


© Motorola BX431G: IMEI 35948604203695 (September 2013 — February 2014) 


6. SIM Cards with One of the Following Identifiers 


IMSI (stored digitally on the SIM card): 
© 310410088779408 
© 310410248923744 
© 310410492968953 
© 310410758808198 
© —310410774223342 
© 310410785717450 
© 310410178586207 
© =310410208687757 
© 310410248923744 
© =310410283447343 
© =310410331125794 
© 310410408399442 
© 310410676110393 
© —310410785725002 
© 310410614126238 


ree (may be written on outside of SIM card): 
89014104200887794085 


© 89014102232489237447 
© —89014104254929689530 
© —89014103277588081989 
© —89014103277857174507 
b5 per NSD 
incerel’ 
b6 per 
b7C FBI 


HRC-977 


HRC-987 


e ALL FBI INFORMATION CONTAINED 
@ HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318TS0 NSICG 


(RO) (FBI) b6 per FBI 
'b7C per FBI 

From: a 

Sent: it , 2015S: 

Ce: NSD)(JMD).______—__|(CD) (FBI) 


Subject: iPad Minis 
b5 per NSD 
b6 per FBI 


CI b7C per FBI 


1. A1489/FOFMW6SUFCM9 
2. A1432/F4GJG37XF193 


b6 per FBI 
b7C per FBI 


National Security Division 


= as ax 


HRC-988 


, : b3 per FBI 
\7 ( b7E per FBI 


b7E FBI 


HRC-989 


ALL FBI INFORMATION CONTAINED 
” e@ HEREIN IS UNCLASSIFIED 


DATE 05-06-2019 BY CééW46B11 NSICG 


FEDERAL BUREAU OF INVESTIGATION 


(Rev. 05-01-2008) 


Precedence: ROUTINE Date: 06/28/2016 
To: Washington Field 


From: Washington Field 
CI-13 


Contact: SOS oie sa 
Approved By: fy tal 
Drafted By: 
(0) Case ID #: os cae vai 


Title: yj). (8{ MIDYEAR EXAM; 
: MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U//feU0O) Documents details related to the 
investigation’s inability to acquire 19 electronic devices 
potentially utilized to access the hdr22@clintonemail.com or 
hrod17@clintonemail.com e-mail accounts. 


“Classified By: F22M62K21 


Derived Fr 20130301 
assify On: 20411231 


References:  \9) Serial 36 bo pez 
{U}-08) Serial 41 bTE FBI 
Serial 42 


FEDERAL GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6 (E) 
Do not disseminate except as authorized by federal rule of 
criminal procedure 6(e). 


Details: (U//FOUe} During the course of its investigation, the 
Federal Bureau of Investigation (FBI) identified electronic 
devices with e-mail capability associated with former Secretary 
of State HILLARY RODHAM CLINTON through witness interviews, 
Grand Jury subpoena returns and information provided by 
CLINTON’s defense counsel. As of the date of this communication, 
the FBI identified, but was unable to acquire, 19 devices which 
possibly were used to access CLINTON’s hdr22@clintonemail.com or 
hrod17@clintonemail.com e-mail accounts. 


HRC-990 


Beers” 
FEDERAL BUREAU OF INVESTIGATION 


(Rev. 05-01-2008) 


(U//FOUS} Unless specifically noted, the FBI was unable to find 
explicit evidence indicating the devices outlined in this 
communication were connected to either the Bryan Pagliano or 
Platte River Networks (PRN) e-mail servers. However, the FBI was 
unable to identify all of the devices that accessed CLINTON’s e- 
mail or synced with the servers due to the limitations of the 
data and log files available from the hardware collected. 


b3 
qo) [OT be 
b7C per 
b7E FBI 


b5 per NSD 


(U//FO8O) 


b3 
b6 per 
b7C FBI 


HRC-991 


(Rev. 05-01-2008) @ @ 
- b3 per FBI 
FEDERAL BUREAU OF INVESTIGATION ba cae wer 


b3 per FBI 
b5 per NSD 
(U) Apple iPads (Two Identified) : b6 per FBI 
b7C per FBI 
b7E per FBI 


b3 per FBI 


a HRC-992 


(Rev. 05-01-2008) @ e 


FEDERAL BUREAU OF INVESTIGATION 


b5 per NSD 


(U) Laptop and Desktop Computers (Four Identified) 
Ib5 per NSD 


(U/APO8O}+ Finally, the FBI investigation identified an 
Apple MacBook Pro laptop computer which contained a full archive 
of the e-mails from CLINTON’s tenure as Secretary of State. In 
March 2013, CLINTON’s hdr22@clintonemail.com e-mail address was 
publicly released following the on-line posting of e-mail 
exchanges between CLINTON and an informal political advisor, 


4 


_SreReT_ 
HRC-993 


* (Rev. 05-01-2008) @ @ 


“Baerer— 


FEDERAL BUREAU OF INVESTIGATION 


SIDNEY BLUMENTHAL. According to interviews of COOPER and CLINTON 

aide MONICA HANLEY, the event prompted a switch to CLINTON’s new 

e-mail account, hrod17@clintonemail.com, and the creation of an 

archive of CLINTON’s State Department tenure e-mails. In late 

March 2013, HANLEY created an archive of the e-mails in 

CLINTON’s account on an Apple MacBook Pro from HANLEY’s New York 

a peed paar POT shipped the laptop to PRN peaes 
employee in February 2014 to migrate the archive ee ne 
onto the PRN server. Followin migration, he shipped 

the laptop to who was CLINTON’s office 

manager at the indicated she never received the 

laptop from however, she advised that CLINTON’s staff 

was moving offices at the time and it would have been easy for 

the package to get lost during the transition period. The FBI 

did not identify the location of the Apple MacBook Pro computer. 


oe 


HRC-994 


vt b3 
bé 


b7c per 
ei are bIE FBI 


HRC-997 


ALL FBI INECRMATION CONTAINED 
e HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY J76318TS0 NSII 


b6 per FBI 
WF) (FBI b7C per FBI 


From: Turner, Katherine [KTurner@wc.com] 
Sent: ly 05, 2016 10:14 PI 
To: (NSD) (JMI 
Ce: ‘JMD); ISAVAE); 
(WF) (FBI); 

Subject: 

i b6 per FBI 
Thanks very much __| We will let Cheryl and Heather know. 7G gen! Wat 


Sent with Good (www.good.com) 


From: (NSD) b6 per FBI 
Sent: Tuesday, July @5, 2016 10:11:44 PM b7C per FBI 


To: Kendall, David; Turner, Katherine; 
csavey:[_] 
(WF) (FBI) (WF) (FBI) 


Subject: Attorney Notes b5 per NSD 


Hy ; b6 per FBI 
David/Kathering | : b7C per FBI 


Thanks 
a hook 
b7C per FBI 


b6 per FBI 
b7C per FBI 


National Security Division U.S. Department of 


This message and any attachments are intended only for the addressee and may contain 
information that is privileged and confidential. If you have received this message in error, 
please do not read, use, copy, distribute, or disclose the contents of the message and any 
attachments. Instead, please delete the message and any attachments and notify the sender 
immediately. Thank you. 


HRC-998 


ee ae er Eee 


HRC-999 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY J76918T80 WSICG - 


Special Agen{_______— 
Federal Bureau of Investigations 
Washington Field Office 

601 4" Street N.W. 
Washington, DC 20535 


Re: Declination of Bryan M. Pagliano 


Dear Special Agen{_| 


” 
£ 

U.S. Department of Justice 

Criminal Division 

Washington, D.C. 20530 

DEC 29 206 

b6 per 
b7C FBI 
b6 per 
b7C FBI 


The Public Integrity Section has completed its review of allegations concerning Bryan M. 


Pagliano. 


This letter will confirm that we have concluded that initiation of criminal proceedings in 
this matter is not warranted and we have declined prosecution. We understand that your office 


concurs with this decision. 


—— regarding this matter, please call me or contact trial attorney 
| b6 per 


Sincerel: ‘b7C DOJ-CRIM 


Raymond N. Hulser 
Chief 
Public Integrity Section 


HRC-1000 


b3 per 
b7E FBI 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY J76J18T80 NSICG 


M aw 
Seqal (72 


EC oe | | 


re. (9 emcees 


b6 per 
b7C FBI 


HRC-1005 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
e DATE 11-10-2016 BY 376318T80 NSICC 


b6 per FBI 
WF) (FBI b7C per FBI 


From: IWF) (FBI) 
Sent: 16 3:54 PM 
To: WF) (FBI) 
Subject: _ FW? iPad Minis 


b6 per FBI 


From[ ____[(ro) (Fs bic per FBI 


Sent: Monday, March 14, 2016 9:49 AM 
Subject: FW: iPad Minis 

From] (NSD) b6 per FBI 
Sent: Friday, March 11, 20163: b7C per FBI 


To: (RO) (FBI) 
Cc NsD)(IMD)[_—_—«(CD) (FBI) 
Subject: iPad Minis b5 per NSD 


b6 per FBI 


fel b7c per FBI 


1. A1489/FOFMW6S5UFCM9 
2. A1432/F4GJG37XF193 


Thanks, 
b6 per FBI 
b7C per FBI 


HRC-1006 


b3 per FBI 


178 b7E per FBI 


b3 
bé 

b7c per 
b7E FBI 


HRC-1007 


David E. Kendall, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


Dear Mr. Kendall, 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318TS0 NSICG 


U.S. Department of Justice 


National Security Division 


Washingion, DC. 20330 


July 21, 2016 


b5 per NSD 


HRC-1008 


b6 per 
b7C FBI 


HRC-1009 , 


ALL FBI INFORMATION CONTAINED 
r } HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318T80 NSICG 


FD-302a (Rev. 10-6-95) 
-1- 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 07/21/2016 


b6 per DOS, FBI 
b7C per DOS, FBI 


On July 21, 2016, Special Agen ____rovided] ett United States 


Department of State, Diplomatic Security Service, a package containing the following two (2) DVDs: 


“Final Production to U.S. Department of State Disc 1; Datasets 1-3” Disc #DEHQ76 


b6 Per 


“Final Classification Determinations” Disc #DEHQ75 
b7c Dos 


A copy of the FD-597 [Receipt for Property] signed by___hcknowledging the receipt of 
said DVDs is enclosed in an accompanying 1A, along with a copy of Disc #DEHQ75 


b3 per FBI 
Investigation on _07/21/2016 o—* Washington, D.C. b7E per FBI 
1 


File # TS an Date dictated__ N/A 
b6 per FBI 

ws{ B7C per FBI 

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 

and its contents are not to be distributed outside your agency. 


HRC-1010 


b6 per 
bIC FBI 


HRC-1011 


HEREIN IS UNCLASSIFIED 


3 e@ ALL FBI INFORMATION CONTAINED 
DATE 11-10-2016 BY 376318T80 NSICG 


UNCLASSIFIED/POR-OFFICIATUSE-ONEY 


MEMORANDUM OF UNDERSTANDING 
Between the Federal Bureau of Investigation and the United States Department of State 
Governing Retrieved Materials 


(U) LNTRODUCTION 


1. (U/FORO) This MEMORANDUM OF UNDERSTANDING (“MOU”) between the 
Federal Bureau of Investigation (“FBI”) and the United States Department of State 
(“DOS”) (collectively, the “Parties”) memorializes and confirms the Parties’ agreement 
governing the status and handling of certain information provided by the FBI to DOS in 
furthcrance of agency record determinations by DOS. 


(U) DEFINITIONS 


2. (U/FOUO) The “FBI's Investigation” means the FBI’s investigation concerning a 
referral from the Inspector General of the Intelligence Community (“ICIG") in 
connection with former Sceretary Hillary Clinton's use of a private e-mail server. 


(UAPOBOS “Retrieved Matcrials” means certain information that the FBI has provided 
or that it may in the future provide to DOS for review and detcrmination of DOS agency 
record status. 


we 


(U) BACKGROUND 


4. (UAFEBO) During the course of the FBI’s Investigation, the FBI obtained certain 
information that may include DOS agency records. 


5. (U/FOVO) Pursuant to a July 8, 2016 request from DOS, the FBI notified DOS on July 
12, 2016 that it would provide such information for review and DOS agency record 
determination pursuant to the Federal Records Act and for subscquent Freedom of 
Information Act (FOIA) processing as appropriate. 


(U) UNDERSTANDING AND AGREEMENT 
6. (U//FEYO) The purpose of this MOU is to express and embody the Parties 
understanding and agreement regarding the canditions under which the FBI has provided 
the Retrieved Materials to DOS. 


7. (U//FERE) The Parties understand and agree that the Retricved Materials are being 
provided to DOS for the purpose of conducting a review and determination of DOS 
agency record status. 


a. (U/EOYO) During the review, upon DOS's determination that a document from 
the Retrieved Materials is a DOS agency record, custody of that document will 
immediately transfer to DOS. DOS may then process and usc the identified DOS 


UNCLASSIFIEDAFOR- OFFICIAL CSE-ONELY 


HRC-1012 


b3 per 


UNCLASSIFIED// 


agency record for any lawful and authorized purposc, to include responding to 
FOIA requests. 


b. (U/FEBQ) Except for those Retrieved Materials that are determined by DOS to 
be DOS agency records, DOS will not, absent written consent of the FBI, disclose 
or disseminate the Retricved Materials to anyone other than individuals 
Participating in, assisting, or supervising the DOS record determination process. 


c. (U#FEHS) Upon completion of DOS’s agency record review, any Retrieved 
Materials determined not to be DOS agency records, and any copies of such 
Retrieved Materials made by DOS, will be returncd to the FBI for disposition in 
accordance with FBI policies and procedures. 


8. (U//FEUO) The Parties understand and agree that, until a document within the Retrieved 
Materials is determined to be a DOS agency record, the Retrieved Matcrials shall not 
constitute DOS agency records under the FOIA or any other law; DOS may not intcgrate 
the Retrieved Materials into its records filing systems and may not disseminate or use the 
Retrieved Materials for any purpose other than DOS agency record determination; and if 
DOS receives a request for access to the Retrieved Materials from outside DOS under the 
FOIA or any other law or authority, DOS will notify the FBI of the request. 


9. (U//FEUS) The Partics understand and agree that the FBI will mark the Retrieved 
Matcrials with appropriate classifications to the greatest extent possible, but that the FBI 
was unablc to obtain definitive classification determinations for all documents therein. 


Co F10:IG 


Brian J. Egan \) . Date 
Legal Adviser 
U.S. Department of State 


a aie 
EW | 
E. W. Priestap 

Assistant Director 
Counterintelligence Division 
Federal Bureau of Investigation 


07[ 20] 2016 


Date 


2 


UNCLASSIFIED//FOR- OFFICIAL USE-ONEY 


HRC-1013 


b6 per 
b7c FBI 


HRC-1014 


ALL FBI INFORMATION CONTAINED 
e HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY J76318T80 NSICG 
FD-302a (Rev. 10-6-95) 
Ae 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 08/05/2016 


b6 per DOS, FBI 
b7C per DOS, FBI 


On August 5, 2016, Special Agenf_______Iprovided___—sdf the United 
States Department of State, Diplomatic Security Service, a package containing the following two (5) 


DVDs: 


Final Production to U.S. Department of State, Disc 2; Dataset 4 
Final Production to U.S. Department of State, Disc 3; Dataset 5-9 
Final Production to U.S. Department of State, Disc 4; Dataset 10-14 
Final Production to U.S. Department of State, Disc 5; Dataset 15-19 
Final Production to U.S. Department of State, Disc 6; Dataset 20 


A copy of the FD-597 [Receipt for Property] signed b: cknowledging the receiptof | 6 Per 
said DVDs is enclosed in an accompanying 1A. 1__} b7c DOs 


b3 per FBI 


Investigation on _ 08/05/2016 at Washington, D.C. b7E per FBI 


File # = {8b Date dictated __ N/A 
b6 per FBI 
By S. a b7C per FBI 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


HRC-1015 


= = 


b3 per 
b7E FBI 


HRC-1016 


ALL FBI INFORMATION CONTAINED 
e HEREIN IS UNCLASSIFIED 
DATE 11-10-2016 BY 376318T80 NSICG 


FD-302a (Rev. 10-6-95) 
-1- 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 08/31/2016 


pe b6 per DOS, FBI 
b7C per DOS, FBI 


On August 18, 2016, Special Agenf———————sdprovided|_— dof the 
United States Department of State, Diplomatic Security Service, a package containing one CD-R labeled 
(U) Final Production to U.S. Department of State, Datasets 1-20 File Listings. b6 per DOS 
3 b7C per DOS 
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WALMERHALE 


September 10, 2015 


bé 
ee b7C 
National Security Division 


Department of Justice 
Washington, D.C. 201530 


By Email; b6 
b7C 
Dea 


Thank you for talking with us on September 8 and 9, 2015, regarding our voluntarily providing 
the BI two laptop computers and one external hard drive that belong to Justin Cooper. We have 
described these devices (hereinafter “Mr. Cooper’s computer hardware”) more fully in the 
enclosed document. This letter memorializes our agreement with the government about the 
removal of Mr. Cooper’s personal and business files from Mr. Cooper’s computer hardware. 


As we discussed and as the government has agreed, before providing Mr. Cooper’s computer 
hardware to the FBI, we will remove and securely delete Mr. Cooper’s personal and business 
files. We will load personal and business files selected by Mr. Cooper onto a new computer 
owned by Mr. Cooper, and he will be free to retain and use that data in the ordinary course 
without restriction. WilmerHale will maintain and securely store a complete copy of all personal 
and business files removed from Mr. Cooper’s computer hardware until such time that we reach 
a written agreement with the government as to what portion we should retain. 


The following files will remain on Mr. Cooper’s computer hardware when it is provided to the 
FBI: (1) Mr. Cooper's emails to and from Secretary Clinton while she was in office extracted 
from his email files; and (2) back-up copies of Secretary Clinton’s blackberry device. As we 
discussed and agreed regarding our consent for these remaining files on Mr. Cooper's computer 
hardware: 


1. We authorize the government to possess and review all of Mr. Cooper’s emails to or 
from Secretary Clinton while she was Secretary of State (January 21, 2009, to 
February 1, 2013). During that time, Secretary Clinton occasionally sent Mr. 
Cooper emails for hand-delivery to her husband, President Clinton. We are aware 
that some of those emails contain information marked “Attorney Client Privilege.” 


2. We authorize the government to possess files labeled as back-up copies of Secretary 
Clinton’s blackberry device. These files do not belong to Mr. Cooper and we 
therefore lack the authority to consent to an examination of their contents. 


Mr. Cooper’s computer hardware contains one or more files labeled as back-up 
copies of blackberry devices, but that are not further labeled with an owner’s name 


Wilmer Cutler Pickering Hale and Dorr tr, 1875 Pennsylvania Avenue NW. Washington, DC 20006 
Beijing Berlin Boston Brussels Denver Fiankturt. London Los Angeles New York = Uxlord.— Palo Alic.-— Washungton 
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As we discussed and as the government has agreed, we will open those files” for the 
sole purpose of determining whether one or more of them is a back-up copy of 
Secretary Clinton’s blackberry device. Any file determined to be a back-up copy of 
her blackberry device will remain on Mr. Cooper’s computer hardware and be 
provided to the FBI. As with the files labeled with Secretary Clinton’s name, these 
files do not belong to Mr. Cooper and we therefore lack the authority to consent to 
an examination of their contents. 


Mr. Cooper will not transfer, copy, or rctain in any form the files that will remain on Mr. 
Cooper’s computer hardware provided to the FBI. 


Sincerely . b6 
b7c 


* Our forensics team will first copy these files to an external drive and open and review them in that location. Our 
team will not open those files on the original machine. 
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Justin Cooper's Computer Hardware 


One (1) silver Apple brand Mac Book Air laptop computer, Serial Number 
C02LFOICFM74 


One (1) silver Apple brand Mac Book Pro laptop computer, Serial Number 
W89361H6644, and charging cord 


One (1) black Seagate brand external hard drive, Serial Number NASAGV8A, and USB 
cord 
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September 24, 2015 


= a b7c 
National Security Division 


Department of Justice 
Washington, D.C. 201530 


Pursuant to our letter agreement with the government dated September 10, 2015, today we 
voluntarily provided the FBI one silver Apple brand Mac Book Air laptop computer, Serial 
Number C02LF0ICFM74 (“Mac Book Air”), that belongs to Justin Cooper.' We provided the , 
Mac Book Air for the purposes of DO./FBI’s investigation of Secretary Clinton’s personal email 
accounts. 


As agreed, we have securely deleted from the Mac Book Air Mr. Cooper’s personal and business 
files, and we have overwritten its unallocated space with zeros. WilmerHale is maintaining and 
securely storing a complete copy of all personal and business files removed from the Mac Book 
Air until such time that we reach a written agreement with the government as to what portion we 
should retain. 


The following files remain on the Mac Book Air: (1) Mr. Cooper’s emails” to and from 
Secretary Clinton while she was in office extracted from his email files; and (2) back-up copies 
of Secretary Clinton’s blackberry device. The attached document describes in greater detail the 
files remaining on the Mac Book Air. As we agreed on September 10, 2015, regarding our 
consent for the files remaining on the Mac Book Air: 


1. We authorize the government to possess and review all of Mr. Cooper’s emails to or 
from Secretary Clinton while she was Secretary of State (January 21, 2009, to 
February 1, 2013). During that time, Secretary Clinton occasionally sent Mr. 
Cooper emails for hand-delivery to her husband, President Clinton. We are aware 
that some of those emails contain information marked “Attorney Client Privilege.” 


2. We authorize the government to possess the files labeled as back-up copies of 
Secretary Clinton’s blackberry device. These files do not belong to Mr. Cooper and 
we therefore lack the authority to consent to an examination of their contents. 


' We will provide the FBI an additional laptop computer and an external hard drive that also belong to Mr. Cooper at 
a later date. 


? We treated any email addressed to or from Mr. Cooper as his email. As such, the Mac Book Air contains not only 
those emails that were sent between Mr. Cooper and Secretary Clinton, it also contains emails that were addressed to 
both Mr. Cooper and Secretary Clinton (within the same email) 
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The Mac Book Air contained one or more files labeled as back-up copies of blackberry devices, 
but that were not further labeled with an owner’s name. As we discussed and as the government 
agreed, we opened those files’ for the sole purpose of determining whether one or more of them 
was a back-up copy of Secretary Clinton’s blackberry device. None of those files contained an 
email account belonging to Secretary Clinton. 


Mr. Cooper has not transferred, copied, or retained in any form the files that remain on the Mac 
Book Air. WilmerHale is temporarily holding an image of the Mac Book Air hard drive (which 
includes the files that remain on the Mac Book Air); we created this drive to enable us to restore 
data in the event our forensics team made an error when segregating and removing data. We are 
not aware of our forensics team making any errors, thus we will securely delete the image of the 
Mac Book Air in seven calendar days from today unless you advise us in writing that the files 
listed on the attachment (i.¢., the files remaining on the Mac Book Air) are corrupted or that their 
contents are otherwise irretrievable for reasons that could be cured with the image of the Mac 
Book Air. After we provide Mr. Cooper’s remaining laptop to the FBI, and after a similar 
waiting period, we will degauss the drive that contains the image of the Mac Book Air drive. 


b6 
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enclosure 


> Our forensics team first copied these files to an external drive and opencd and reviewed them in that location. Our 
team did not open those files on the Mac Book Air. 
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Pursuant to our letter agreement with the government dated September 10, 2015, today we 
voluntarily provided the FBI one silver Apple brand MacBook Pro laptop computer, Serial 
Number W89361H6644 (“MacBook Pro”), that belongs to Justin Cooper.' We provided the 
MacBook Pro for the purposes of DOJ/FBI’s investigation of Secretary Clinton’s personal email 
accounts. 


As agreed, we have securely deleted Mr. Cooper’s personal and business files from the MacBook 
and we have overwritten its unallocated space with zeros. WilmerFale is maintaining and 
securely storing a complete copy of all personal and business files removed from the MacBook 
Pro until such time that we reach a written agreement with the government as to what portion we 
should retain. 


The following files remain on the MacBook Pro: (1) Mr. Cooper’s emails? to and from Secretary 
Clinton during her tenure as Secretary of State extracted from his email files; and (2) back-up 
copies of Secretary Clinton’s blackberry device. The attached document describes in greater 
detail the files remaining on the MacBook Pro. We resolved several issues for the MacBook Pro 
as follows: 


¢ Using MDS hash values, Kroll determined that two text files on the MacBook Pro were 
identical to two text files on the MacBook Air provided to the FBI on September 24, 
2015. As we agreed, because those files are identical and had therefore already been 
preserved in Kroll’s processing of the MacBook Air, we did not review and save the 
responsive portions of those two files on the MacBook Pro. 


* Again using MDS hash values, Kroll determined that two text files on the MacBook Pro 
were identical to each other. As we agreed, because those files were identical to each 
other, Kroll processed only one of them. 


' We will provide the FBI an external hard drive that also belongs to Mr. Cooper at a later date. 


? We treated any email addressed to or from Mr. Cooper as his email. As such, the MacBook Pro contains not only 
those emails that were sent between Mr. Cooper and Secretary Clinton, it also contains emails that were addressed to 
both Mr. Cooper and Secretary Clinton (within the same email). 
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ing Hale and Dorr ir, 1875 Pennsylvania Avenue NW, Washington, DC 20006 
Denver Frankturt_ London Los Angeles New York Oxtord Palo Ato Washington 
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¢ Like the MacBook Air, the MacBook Pro contained files labeled as back-up copies of 
blackberry devices, but that were not further labeled with an owner’s name. Kroll 
matched those files to the unlabeled blackberry back-up files on Mr. Cooper’s MacBook 
Air using MDS hash values. As described in my letter of September 24, 2015, Kroll had 
previously determined those files on the MacBook Air did not contain an email account 
belonging to Secretary Clinton. 


As we agreed on September 10, 2015, regarding our consent for the files remaining on the 
MacBook Pro: 


¢ We authorize the government to possess and review all of Mr. Cooper’s emails to or from 
Secretary Clinton while she was Secretary of State Qanuary 21, 2009, to February 1, 
2013). During that time, Secretary Clinton occasionally sent Mr. Cooper emails for 
hand-delivery to her husband, President Clinton. We are aware that some of those emails 
contain information marked “Attorney-Client Privilege.”? 


¢ We authorize the government to possess the files labeled as back-up copies of Secretary 
Clinton’s blackberry device. These files do not belong to Mr. Cooper and we therefore 
lack the authority to consent to an examination of their contents. 


Mr. Cooper has not transferred, copied, or retained in any form the files that remain on the 
MacBook Pro. WilmerHale is temporarily holding an image of the MacBook Pro hard drive 
(which includes the files that remain on the MacBook Pro and the text files described above) to 
enable us to restore data in the event our forensics team made an error when segregating and 
removing data. We are not aware of our forensics team making any such errors, thus we will 
securely delete the image of the MacBook Pro and degauss the drive in seven calendar days from 
today unless the government advises us.in writing that the files listed on the attachment (ie., the 
files remaining on the MacBook Pro) are corrupted or that their contents are otherwise 
irretrievable for reasons that could be curcd with the image of the MacBook Pro hard drive. 


b6 
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Enclosure 


> Because Mr. Cooper's emails contain information marked “Auorney-Client Privilege,” David Kendall, counsel to 
Secretary Clinton, is reviewing Mr. Cooper’s emails. 
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ATTACHMENT 
JG Cooper MacBook Pro // 10022015 
(Item numbers have no significance; used here for sake of reference) 
Item 1 
hre saved 2 
macbook pro\Single Files\pro - responsive\hre saved 2 


Item 2 


hre BlackBerry Curve (24B603D0) (2011-11-26) - Full.bbb 


bbb 10/2/2015 0:00 10/2/2015 16:49 1¢3c62€765f7b85d9cc35 f3c0cf57f7e 
macbook pro\Single Files\pro - responsive\hre BlackBerry Curve (24B603D0) (2011-11- 
26) - Full.bbb 

Item 3 


hre saved.bbb 


bbb 10/2/2015 0:00 10/2/2015 16:49 bca9c5661494e1 Sclaal f8902ce9ab! | 
macbook pro\Single Files\pro - responsive\hre saved.bbb 


Item 4 


HR BlackBerry Bold 9900.ipd 


ipd 10/2/2015 0:00 10/2/2015 16:49 acaf592275644075510cf53110df4567 
macbook pro\Single Files\pro - responsive\Mail Download\HR BlackBerry Bold 
9900.ipd 


Item 5 


hre saved (folder) 


Item 6 


hre Backup-(2009-04-13).ipd 


ipd 10/2/2015 0:00 10/2/2015 16:49 af8ad110a4faf0fa42341a6151675(6F 
macbook pro\Single Files\pro - responsive\hre Backup-(2009-04-13).ipd 


Item 7 
Archive_email.mbox 


mbox macbook pro\Single Files\pro - responsive\Archive_email.mbox 
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Item 8 
Responsive - PC Mail - Sent Items.mbox 


mbox macbook pro\Single Files\pro - responsive\Responsive - PC Mail - Sent 
Ttems.mbox 


Item 9 
responsive PC Mail inbox old server inbox.rtf 


rif 10/2/2015 0:00 10/2/2015 16:49 18ed6542b5e4ab369384bdbbc7d3fa2 
macbook pro\Single Files\pro - responsive\responsive PC Mail inbox old server inbox.rtf 


Item 10 
responsive PC Mail Inbox.rtf 


rtf 10/2/2015 0:00 10/2/2015 16:49 ac71599abc6d62ff95482ce7c8012f9a 
macbook pro\Single Files\pro - responsive\responsive PC Mail Inbox.rtf 


Item 11 
hre saved.zip 


zip —_-10/2/2015 0:00 10/2/2015 16:49 bca9c5661494e1 Sclaal [8902ce9abI 1 
macbook pro\Single Files\pro - responsive\hre saved.zip 


Item 12 
hre saved.xml 


xml 10/2/2015 0:00 10/2/2015 16:49 bca9c5661494e1 Sclaal {8902ce9ab1 | 
macbook pro\Single Files\pro - responsive\hre saved.xml 


Item 13 
Mail Download 


macbook pro\Single Files\pro - responsive\Mail Download 
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1 | From 
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(WE) (FBI) 


ee bic per DOS, 5 
From: | b7C per DOS, FBI 


Sent: Friday, November 06, 2015 12:01 PM 
To: (WF) (FBI) 
Subject: Case email 

Follow Up Flag: Follow up 

Flag Status: Flagged 

Look for 


FW: 2003 Cable 


Or 
Ld b6 per Dos, FBI 
Senior Special Agent : 


Office of Investigations 
Office of the Inspector General 


of State 
office 
cell 


HRC-1160 


” Federal Taxpayer Information (FTI) 


ALL FBI INFORMATICGN CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 10-25-2017 BY Cé6W46B11 NSICG 


| art 
FD-340 (Rev. 4! { 


File Number 302. bre 


Field Office Acquiring Evidence WE, 


Serial # of Originating Document ue, 
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(Address) 
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U.S. Department of State 
PROPERTY TRANSACTION 


Issue Reutilization 


1. Date aaa a 
10-29-2015 
4, Loan Information 


Date Loan Ends (mm-dd-yyyy) Date Loan Retumed (mm-de-yyyy) 
5. Requestor’s Name (Print Name) 


\ 
10. Justification or Remarks 


Desktop tured over to FBI as part of an ongoing investigation 


3. Contro! Authorization Number 


O tumin Loan [&)_ Transfer 


11. Authorizing Officer (Print Name) 
13. Approving Officer lame) 
15. Deliver or Ship to (List Registry Information 
16. Property Detalls 
Property Number ‘Serial Number Description Quantity Condition | Unit Cost Total Cost 


Dsp003540 |__| 2UA9261HHK HP dc5850 SFF 1 good 0.00 
| 


Records Updated by (Initials) Date (mm-da-yyyy) 


18. hereby acknowledge receipt of the items of property listed above. | understand that | am financially liable, in accordance with14 FAM 411.2-9 
and 423.8, forthe value of any property Issued or loaned tome. 


| Recelved By Mae) 


Signature y Date (mm-da-yyyy) 


(User Name) | 


08-0584 T 
08-2015 
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ae GENERAL INSTRUCTIONS 


Enter the date the form DS-584 Is prepared. 


Action 

Enter an "X" In the select action field to Indicate the type of property action. 

* Issue - assat(s) Issued to or moved from the warehouse or storage facility to an employee, office, residence, or other location. 

+ Tum In - asset{s) tumed In or moved from an employee, office, residence, or other location back'to.the warehouse or storage facility 

+ Loan - asset(s) provided to an entity (see 14 FAM 412.4-2 (a) for spectfics) for a period of less than 90 days and/or no more than a year. 


+ Reutilization - the movement of an asset within a bureau or post from one location to another. The movement of an asset from one bureau 
or post to another bureau or post. 
Transfer - the movement of eeset() from DOS to another federal agency when tte is passed. 


(3) 


\° 
| 

|System generated by ILMS. 
H . 


(4.) Loan Information 
[Enter the date the loan ends and the date the loan is retumed. 


(6) Requestor Name (Print Neme) ee 
Enter thé name of the receiving agency/postbureau contact. 

(6) Post/Agency/Bureay coe 
‘Enter the'name of the recelving agency/post/bureau. 
(7.) Qffice 

Enter the name of the office. 


(8.) Room Number 
Fier the room number. 


(9.) Telephone Number 
Enter the telephone number of the recelving agency/post/bureau contact. 


(10.) Justification or Remarks 
Enter the reason for the request and any other item specific details. 


(11.) Authorizing Officer (Print Name) 
Enter the authorizing officer name. 


Enter the authorizing officer signature ‘and (14 FAM 411. 2, 14 FAM 414, and 14 FAM 425). 


(13.) Approving Officer (Print Name). 
Enter the approving officer name. 


(14) Ap 
Enter the approving offcer signature and date (14 FAM 411. 2, 14 FAM 414, and 14 FAM 428). 


(15.) Deliver or Ship to (List Realstry Information) 
The delivery address of the agency to which the property is being transferred. 


(16.) Property Detalls. 
Property Number - 
Enter the nonexpendable property application (tag) property number. 
Serial Number - 
Enter any serial number. 


Each line will be a one-item ent. 
Condition - 

Indicate the condition of the property. 
Unit Cost - 

Enter the unit cost. 

Total Cost - 


Enter the total cost. 


(17) 


Update property records. 
(18,) Receipt 
> ‘The receiving ager 5 
DS-0584 ' Instruction page 1 of 4 
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UNITED STATES DEPARTMENT OF. JUSTICE sey Ge 
FEDERAL BUREAU OF INVESTIGATION : : 
Receipt for Property Received/Returned/Releaséd/Seized 


File: # 


. Pol 
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( Returned To... | # 
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C Seized Oo pe sre 
(Name). : : ae 


(Street Address) 2072S E sy. Nw 
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; ee be 
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UNCLASSIFIED STATE DEPT. - PRODUCED TO HOUSE SELECT BENGHAZI COMM. 
U.S. Department of State SUBJECT TO AGREEMENT ON SENSITIVE INFORMATION & REDACTIONS. NO FOIA WAIVER. 
Case No. F-2015-04841 
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From: Abedin, Huma <AbedinH@state.gov> 

Sent: Sunday, April 10, 2011 10:14.AM 

To: H 

Subject: Fw: Stevens Update (Important) 

‘importance: High 

Jake may have:sent but in case not.. yw 

—~ Original Message -—— 40 wh 

From: Davis, Timmy 7 Ry NA 


Sent: Sunday, April 20, 2011 06:48 AM 4 
To: Sullivan, Jacob J; Abedin, Huma; Wells, Alice G; $_SpecialAssistants 
Subject: Stevens Update (important) 


(SBU) Per Spacial Envoy Stevens: 


The situation in Ajdablysh has worsened to the paint where Stevens is considering departure from Benghazi. The 
envoy’s delegation is‘currently doing a phased checkout (paying the hotel bills, moving some comms to the boat, 
etc). He will monitor the situation to see if it deteriorates further, but no decision has been made on departure. He will 
‘walt 2-3 more hours, then revisit the decision on departure. 


He-received reports of shelling last night in Ajdabiyah as well.as:snipers shooting people In the city. AFRICOM 
reported Qadhafi’s forces took the eastern and western gates of Ajdablyah, with 5 vehicles at the eastern gate and SO at 
the western gate. More Qadhafi forces are heading to Ajdablyah from Brega. 


The Brits report Qadhafi forces are moving from Sirte to Brega, which they interpret as preparation for another 
assault on Ajdabiyah today. 


He plans to discuss the situation further with the Brits, Turks, and the TNC to see if this is an irreversible 
situation, Departure would send a significant political signal, and would be interpreted as the U.S, losing confidence In 
the TNC. Initial message to the TNC would frame the departure as due to security grounds and as a temporary measure 
only. 


Polaschik said she would discuss these developments with Amb..Cretz. 


If the group departs, the contract for the boat stipulates they return to Greece. One scenario could be the group 
stages:elsewhere for a few days. 


Ops will continue to monitor the situation. 
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National Security Division 


Department of Justice 
Washington, D.C. 201530 
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Pursuant to our letter agreement with the government dated September 10, 2015, today we 
voluntarily provided the FBI one black Western Digital brand My Passport Ultra external hard 
drive, Serial Number WXG1AA3M2130 (“WD Passport Drive”),' containing certain data 
requested by the government. We provided the WD Passport Drive for the purposes of 
DOJ/FBI’s investigation of Secretary Clinton’s personal email accounts. 


The WD Passport Drive contains the following files: 


1. Mr. Cooper’s emails” to and from Secretary Clinton during her tenure as Secretary of 
State extracted from a copy of Mr. Cooper’s personal and business files from his 
MacBook Air and MacBook Pro laptop computers. * 


As you know, we voluntarily provided the FBI with Mr. Cooper’s MacBook Air and MacBook 
Pro on September 24, 2015, and October 5, 2015, respectively. Each machine contained Mr. 
Cooper’s emails to and from Secretary Clinton during her tenure as Secretary of State extracted 
from email files contained on those machines (along with back-up copies of Secretary Clinton’s 
Blackberry device). Per our agreement with the government, Kroll identified those emails using 
the spotlight tool that was native to the laptops and worked exclusively on the laptop, i.¢., Kroll 
did not load or use any forensic tools to identify and isolate these emails. 


WilmerHale retained a complete copy of Mr. Cooper’s personal and business files removed from 
his MacBook Air and MacBook Pro by creating a “Time Machine” copy of those files. We then 
reviewed those Time Machine copies using forensic tools and identified Mr. Cooper’s emails to 
and from Secretary Clinton that are contained on the WD Passport Drive. We have securely 
deleted these emails from the personal and business files retained by WilmerHale. 


' The WD Passport Drive is encrypted; we provided the password to the FBI. 


? We treated any email addressed to or from Mr. Cooper as his email.: As such, the WD Passport Drive contains not 
only those emails that were sent between Mr. Cooper and Secretary Clinton but also contains emails that were 
addressed to both Mr. Cooper and Secretary Clinton (within the same email). This letter refers to such email as 
“responsive” if it was also dated between January 21, 2009, and February 1, 2013 (Secretary Clinton’s tenure as 
Secretary of State). 


Wilmer Cuder Pickering Hale and Dorr ur, 1875 Pennsylvania Avenue NW, Washington, DC 20006 
Beijing Berlin Boston Brussels Denver Frankfurt. London Los Angeles New York Oxford Palo Alto. Washington 
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We believe that we previously produced a majority, likely a vast majority, of the emails on this 
portion of the WD Passport Drive and that our Time Machine inadvertently captured them as 
emails that were not produced. Our use of forensic software enabled us to identify, isolate, and 
remove them from the Time Machine. 


2. Mr. Cooper’s emails to and from Secretary Clinton during her tenure as Secretary of 
State, as well as backup copies of Secretary Clinton’s Blackberry devices, extracted from 
an archival image of Mr. Cooper’s MacBook Air laptop computer dated December 30, 
2013 (“12/30/13 Image”). 


WilmerHale is maintaining and securely storing a complete copy of all personal and business 
files removed from the 12/30/13 Image until such time that we reach a written agreement with 
the government as to what portion we should retain. WilmerHale is also temporarily holding a 
complete copy of the 12/30/13 Image. We will securely delete that complete copy in seven 
calendar days from today unless you advise us in writing that the files on the WD Passport Drive 
are corrupted or that their contents are otherwise irretrievable for reasons that could be cured 
with the copy we retained? 


3. Mr. Cooper’s emails to and from Secretary Clinton during her tenure as Secretary of 
State, as well as backup copies of Secretary Clinton’s Blackberry devices, extracted from 
an archival image of Mr. Cooper’s MacBook Air laptop computer dated August 30, 2015 
(8/30/15 Image”). 


This set of emails includes Mr. Cooper’s emails to and from Secretary Clinton during her tenure 
as Secretary of State extracted from backup copies of Mr. Cooper’s Blackberry devices. By 
comparing MDS hash values, Kroll determined that other known backup copies of Mr. Cooper’s 
Blackberry devices were forensically identical to those on the 8/30/15 Image. For this reason, as 
we agreed with the government: (1) Kroll isolated (and we have produced) responsive emails 
from backup copies of Mr. Cooper’s Blackberry devices located only on the 8/30/15 Image; and 
(2) we are retaining the non-responsive portion of the backup copies of Mr. Cooper’s Blackberry 
devices with responsive emails from only the 8/30/15 Image. 


WilmerHale is maintaining and securely storing a complete copy of all personal and business 
files removed from the 8/30/15 Image until such time that we reach a written agreement with the 
government as to what portion we should retain. WilmerHale is also temporarily holding a 
complete copy of the 8/30/15 Image. We will securely delete that complete copy in seven 


3 As you know, we temporarily held images of the MacBook Air and MacBook Pro drives (including files that 
remained on those machines when they were delivered to the FBI) for the same purpose. You subsequently advised 
us that the FBI was able to open the files on those machines and we therefore securely deleted those images. 
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calendar days from today unless you advise us in writing that the files on the WD Passport Drive 
are corrupted or that their contents are otherwise irretrievable for reasons that could be cured 
with the copy we retained. 


As we agreed on September 10, 2015, regarding our consent for the files remaining on the WD 
Passport Drive: 


© We authorize the government to possess and review all of Mr. Cooper’s emails to or from 
Secretary Clinton while she was Secretary of State (January 21, 2009 to February 1, 
2013). During that time, Secretary Clinton occasionally sent Mr. Cooper emails for 
hand-delivery to her husband, President Clinton. We are aware that some of those emails 
contain information marked “Attorney-Client Privilege.” 


e We authorize the government to possess the files labeled as back-up copies of Secretary 
Clinton’s Blackberry device. These files do not belong to Mr. Cooper and we therefore 
lack the authority to consent to an examination of their contents. 


We stated in our letters dated September 24, 2015, and October 5, 2015, that Mr. Cooper had not 
transferred, copied, or retained in any form the files that remained on the MacBook Air and the 
MacBook Pro. We have since determined that the 12/30/13 Image and the 8/30/15 Image 
described in this letter contained duplicates of certain files we provided to the FBI on the 
MacBook Air and MacBook Pro. As noted above, those files are contained on the WD Passport 
Drive; we will not transfer, copy, or retain those files except as described above. In addition, we 
have determined that our review/production protocol isolated and produced Mr. Cooper’s emails 
to and from Secretary Clinton, but generally did not lead to us isolating and producing duplicates 
of those emails that were contained in longer chain emails that did not otherwise satisfy the 
criteria of your request. As you have requested, we are isolating those email chains for 
production. 
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For some reason | cannot find your email requesting | look for my phone logs. But | remember that | owe youa 
response. | have looked through the logs and records | kept. Unfortunately | only kept my notebooks right around and 
just after the Benghazi incident, i.e., in August and September 2012. | don’t have any notebooks for later months. Sorry. 
Please let me know if there is anything else | can do. Regards, 
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From: H <hrod17@clintonemail.com> 

Sent: e Sunday, September 13, 2009 7:48 AM 

To: ‘millscd@state.gov' 

Ce: ‘sullivanjj@state.gov’; ‘abedinh@state.gov’ 
Subject: Re: For S -- for discussion on Afghanistan tomorrow 
Yes. Thx. 

s+-++ Original Message ----- 

From: Mills, Cheryl D <MillsCD@state.gov> 

To: H 


Cec: Sullivan, Jacob J <SullivanJ@state.gov>; Abedin, Huma <AbedinH@state.gov> 
Sent: Sun Sep 13 07:47:17 2009 
Subject: FW: For S -- for discussion on Afghanistan tomorrow 


|s this what you are speaking of? 
tarved + pap Oeterm ine whad He 
Su 4 what She didnz 


so---Original Message----- 
From: Ertan Anne-Marté 


b6 per 
b7C FBI 


bl per 
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Introduction 

© Voluntary / Can stop at any time 

© NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 

o FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. FBI is sensitive to conflicting opinions on the classification of 
materials — same info from two sources may have different classification levels based 
solely on the source of the info, 


e Brief overview of role(s) between 2/09 and 1/13. 


b7C 


. Fre{uency and method of communication with the Secretary oa we! 
o Access to/ training on handling of classified information. y 
= Guidance on handling classified leaks, or inquiries from press 
e Knowledge of the server 


© Frequency of emails to / from 
© Guidance on sending material to the server 
© Procedure for communicating classified information to the Secretary (if applicable) 
= — Did it vary when she was traveling, in NY, etc. 
© Concerns with the use of the server or other communication channels 
_ Discussion of specific email(s) 


© ICIG believed that classified information may be contained in email sent by Slaughter 6 
(subject “For S — for discussion on Afghanistan tomorrow’) BIC 
oo. Details surrounding the email chain in question. 
= What was the source of the information cited 
| a 
= How did you communicate sensitive / classified information 
= Typical of other communications made via email? 
e Any other thoughts / concerns regarding this matter. 
e NDA request 
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. yp apegaee b7c 
Voluntary / Can stop at any time =; 


NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 

FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. FBI is sensitive to conflicting opinions on the classification of 
materials — same info from two sources may have different classification levels based 
solely on the source of the info, 


ooo°o 


b6 
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= Frequency and method of communication with the Secretary 
o Access to / training on handling of classified information. 
* Guidance on handling classified leaks, or inquiries from press 


Knowledge of the server 
© Frequency of emails to / from 
© Guidance on sending material to the server No 
© Procedure for communicating classified information to the Secretary (if applicable) 
= Did it vary when she was traveling, in NY, etc. 
© Concerns with the use of the server or other communication channels 
® Discussion of specific email(s) 
© ICIG believed that classified information may be contained in email sent by Slaughter 
(subject “For S — for discussion on Afghanistan tomorrow’) 
©. Details surrounding the email chain in question. 


= What was the source of the information cited 
bé 


2 b7c 


® How did you communicate sensitive / classified information 
® Typical of other communications made via email? 

Any other thoughts / concerns regarding this matter. 

NDA request 
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From: ~~ F— Pamaitcom 
Sent: - lednesdi ebruary 03, 2016 10:11 AM 
To: ae (WF) (FBI) 

Subject: ‘mail Chain 


Attachments: .Febriary 32016 Letter tf af 
Dear Special Agent , . be 
ear Special Agent|_ ae 


As discussed, attached is the email chain. 


‘Please:do not hesitate to.contact me with any questions. ” 


‘Warmly, 


| 
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February 3, 2016 


b6 


a b7c 
pecial Agen’ 


FBI, execs Field Office 
Dear Special Agent{ | 


As discussed, below you will find the email chain we have been discussing. Please do not 
hesitate to contact me with any questions. 


Very warmly, 


/s/ 


b6é 
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Ambassador Stephen Mull 
Executive Secretary (2011) 


Ly Telephonel_____‘{Office Manager {| 


e Introduction 


o Voluntary / Can stop at any time WA 
o  NSLB Disclaimer re: Garrity / not interested in prior statements to posW 
© FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. 
e Brief overview of duties as the Executive Secretary 
o What were you duties as they related to the operation of the Secretary’s private server, 
or other mobile comms platforms? Nv rhe. ia 
o What were your duties as related to the Ops Center? . wa semng.ve 
Fir Sela nfainicy 


Not resernsible 


Knowledge of the private server andemail —- | MP 


Kned dec nad ewn ¢ | acerunt 


co Was there an approval process for the use of private email / email servers? 


If so, what is the approval process for this arrangement? Not aWwdee- of pou Sea 
What steps were taken to review the risks / benefits of this arrangement? 
Who was involved in the review process? 
Was this consistent with DoS policy at that time? 
Did the server violate department policy as stipulated in the Foreign Affairs 
Manual? 
What is the current policy today? 
© When / why did it change? 


o Who had knowledge of the server from DOS at the onset? 


When did you become aware of the arrangement? 


o Did DOS have any role in setting up and / or maintaining the server? 


If so, who specifically was responsible for this? 7 domi Knrp 
¢ DoSemployee, or a contractor? 
co If contractor, what steps to ensure actions were consistent with 
IMS-POEMS procedures, protocols? 
© If contractor, what steps to ensure appropriate threat 
monitoring? 
o Knowledge of Brian Pagliano’s role? Payment structure? 
¢ What steps were taken to ensure appropriate security protocols were in 
place (updates, patches, antivirus, intrusion monitoring)? 
© Who paid for the set up costs and maintenance costs? 
e Were the secretary’s server related expenses reimbursed by State? 
0 If paid for by State, what is the policy on paying for the 
maintenance of personal property? 


o What guidance was provided by DoS regarding the transmission / storage of sensitive 
and/or classified information on the server? 


HRC-1366 
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o What secure comms were available to the secretary at her home and when she was 


traveling? 
= Phone 
= Fax 


= Email (Classnet / JWICS) 
¢ Discussion of emails 
o August 2011 email regarding state issued BB (connectivity issues following hurricane 
Irene) 
© November 2010 email regarding Bluetooth vulnerabilities (CLASSNET — SECRET) 
= Why was this sent to Cheryl? (i.e., was it requested, was it standard to send 
such alerts, etc) 
= Did they request the offered briefing / demo? 
Were the implied recommendations to disable Bluetooth implemented? 
¢ Bywhom? 
¢ Who maintained her blackberry w/ respect to security etc 
© Did you have direct contact with them? How often? 
o Did they request information about DoS security 
recommendations? How often? 
o. July 2010 Email (use of mobile device in office) 
= Background context on this? 
¢ What device are they referring to (ipad)? 
What was the resolution — was she able to use it in her office? 
© Did she use other devices in her office? 
Who else was involved in these discussions / approvals 
e Any other thoughts / concerns regarding this matter. 
e NDA request 
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From: “Macmanus, Joseph E" <CLASSSTATE/CBPC ADMINISTRATIVE 
GROUP/RECIPIENTS/MACMANUSJE> 

Sent: 10/6/2009 6:07:49 PM +00:00 

To: "Mills, Cheryl D" <MillsCD@state.sgov.gov>; “Sullivan, Jacob J" 
<SullivanJJ@state.sgov.gov>; “Abedin, Huma" <AbedinH@state.sgov.gov> 

Subject: IT security in Moscow 


Our Mobile Communications Team sent in an email on electronic surveillance and 
monitoring in Russia, which I’ve excerpted below. The gist of it is: what’s yours is 
theirs. 


We will brief staff at the airport before departure, and post the necessary warnings 
in the hotel. 


From: Mobile Communications Team, Moscow Advance 
Sent: Tuesday, October 06, 2009 10:40 AM 
Subject: IT security in Moscow 


b7E Per DOS 


Yesterday at the RSO’s security briefing, the RSO stated that the IT threat level here 


The following are recommendations regarding IT security in Moscow: 


b7E Per DOS 
Strong recommendation against any classified material or conversations in the 


hotel, including STE conversations and any printed materials, whether brought to 
the hotel by the party or delivered by courier. No matter how well 


The Secretary’s suite _as well 
as the Senior Bureau, the Secretariat, and all bedrooms will ed | 
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Co 


b7E Per DOS 


Strong recommendation against the use of BlackBerries: when you bring your 


ear’ online in Moscow, 


Strong recommendation against computers connected to the Internet in the hotel 


Authorized the use of FOBs in the hotel ONLY for use with government-owned 
laptops under 100% continuous positive control by a cleared American. If left 
unattended at any time, for example, while somebody goes downstairs for 
breakfast, they will be compromised. 


NOTE: a lost or stolen FOB here in Moscow is a major security threat. All must take 
reat care not to loose their FOBs. b7E Per DOS 


DS Lead and DS Logistics indicated that they did not want computers and printers in 
their bedrooms per the IT requirements and would rather work in the Embassy. 
The laptops intended for them are being stored in the Embassy. 


Communications set-up in Moscow: 


Computers issued by MCT or supported by MCT (e.g., Abedin, Sullivan, Macmanus) 
b7E Per DOS 


e Marines and DS will restrict access. Anyone in a bedroom outside of the 
must keep their laptops in their possession at all times 


HRC-1369 
Wilet : 2 y b6 
file://C:/User{ | AppData/Local/Temp/adtemp/ad_tmp_b44bd046 2067-43a8-b0f.. W/27/2016 PS 


+ IT security in Moscow Page 3 of 3 


store them at the Embassy (for example | b7E Per DOS 


Computers we set up in S offices and bedrooms will be laptops owned by the 
Embassy and will remain in our custody while outside of the Embassy. The traveling 
party should be notified that we will have to use laptops instead of desktops at this 


stop. 


b7E Per DOS 


STEs in the S suite: the Secretary should be briefed 


b7E Per DOS 


RSO recommends courier of documents to the hote 


b7E Per DOS 


RSO permits use BlackBerries. AS SOON AS users return to W 
Blackberry will need to be cleane 


Any government laptop used in the hotel and returned to Washington will need to 
The use ofa = aes is not cine BIE POE PRE 
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From: " “Abedin, Huma" <SBUSTATE/SES/RECIPIENTS/ABEDINH> 


Sent: 8/30/2011 9:34:07 PM +00:00 
To: "Mull, Stephen D" <MullSD@state.gov> 
Subject: Re: S Communications 


Its pretty silly and she knows it. 


From: Mull, Stephen D 

Sent: Tuesday, August 30, 2011 05:18 PM 
To: Abedin, Huma 

Subject: RE: S Communications 


Thanks for reminding all of this very helpful context!!! © 


From: Abedin, Huma 

Sent: Tuesday, August 30, 2011 17:17 PM 
To: Mull, Stephen D; Mills, Cheryl D 

Cc: Kennedy, Patrick F; Hanley, Monica R 
Subject: Re: S Communications 


Steve - let's discuss the state blackberry, doesn't make a whole lot of sense. 

As for the equipment, the commo team was limited in some capacity because we did not have 
authorization from owners of residence to install equipment. We did it regardless. Additionally, as S 
knows, the team didn't have access to the property until a couple of hours before S arrived. 

Finally, as even the white house attested, this was a pretty wide spread problem, not just affecting us. 
So we should bear that in mind. 


From: Mull, Stephen D 

Sent: Tuesday, August 30, 2011 01:39 PM 

To: Mills, Cheryl D 

Cc: Abedin, Huma; Kennedy, Patrick F; Hanley, Monica R 
Subject: S Communications 


HRC-1371 


Cheryl, 
Thanks again for alerting me to the communications issues the Secretary has been having. Here’s a status report: 


On the immediate problem of the Secreta ing able to have her callstransferred] Ss] H7E Per DOS 


. On the more long term issue, I’ve asked our team to develop an enhanced package of capabilities and 
equipment that we would propose deploying with the Secretary to be as closely co-located as possible with her 
when she is on travel away from her usual residences. The package will include things that anticipate the 
normally unexpected such as hurricanes, power outages, earthquakes, locusts, etc, such as generators, 
uninterrupted power supplies, supplementary satellite capabilities, including satellite phones for when local 
infrastructure fails (as it did in NY over the weekend). 


Separately, we are working to provide the Secretary per her request a Department issued Blackberry to replace 
her personal unit which is malfunctioning (possibly because of her personal email server is down). We will 
Prepare two versions for her to use — one with an operating State Department email account (which would mask 
her identity, but which would also be subject to FOIA requests), and another which would just have phone and 
internet capability. We're working with Monica to hammer out the details of what will best meet the Secretary's 
needs. 


Please let me know if you need anything more for now, and I'll be in touch with the above longer term options 
soon. 


Thanks, 

Steve 

PR_RIM_MESSAGE_ SUBMISSION 1D: aaa | 
b7E Per DOS 

PR_RIM_PAGER_TX_FLAG: true 


PR RIM INTERNET. MESSAGE_0: a 


PR_RIM_MSG_FOLDER_ID: 5 


PR_RIM_MSG_REF_ID: 876690920 
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ALL FBI INFORMATION CONTAINED 


11/9/2010 4:32:28 PM +00:00 DATE 04-23-2019 BY CééW46B11 NSICG 
“mills, Cheryl D" <MillsCD@state.sgov.gov> 2 
FW: FW: Bluetooth Vulnerabities 


Hi Cheryl, 


Here's the summary of Biuetooth vuinerabilities 1 mentioned. If you'd still like a briefing/demo (which I think you'd find pretty 
interesting/diusturbing), let me know and I'll be happy to set up. Not that I normally like to disturb my boss! 


Steve 


From: Bentel, John A 
Sent: Friday, November 05, 2010 4:23 PM 

To: Mull, Stephen D 

Ce: Lukens, Lewis A; Green, Milton V; Jacks, Yvette R 
Subject: Biuetooth Vulnerabities 


Steve: 


Usted below are vuinerabilities of Bluetooth on a Biackberry. Further down you will find more technical details should you wish to read more, 


At the recommendation of our IT counterparts in DS - I have reached out to DAS Gentry Smith requesting to meet to see if it Is possible to 
enabie Bluetooth and adhere to a security posture. 


Please let me know if you have any questions or concerns. Will keep you posted. 


Thanks, 


John 


a | tye ne 
(s, (8) b7E DOS 
Can be exploited from a considerable distance away and be undetected. ‘ 

Attacker can take full control of the device. 

Attacker can take every email on the device. 

Attacker can set up an attack to move to any new device swapped out using the same SIM. 

Attacker can listen to any phone conversation. 


Attacker can turn the phone into a listening device. 


Able to use the phone to send SPAM emails looking as the user. 
Expanded details foliow: 


Biggest concern to the network: 


© During the August 2006 DEFCON (the annual Las Vegas “hacker convention”), a computer security consultant discovered an 
unauthorized path into corporate information networks - using the BlackBerry. The consuitant developed a hacking program 
exploiting the trust reiatlonship between the BiackBerry and a company’s internal BES server. Because the data tunnel between 
the BlackBerry and the server is encrypted, intrusion detection systems at the perimeter of the network will not detect the attack. 
The technique Is successful because most companies are not equipped to detect someone trying to deliver an expioit from inside a 
network. This Is true in part because few view the BiackBerry as a plausible attack vehicle. 
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file///C:/User{_____ |AppData/Local/Temp/adtemp/ad_tmp_dfac3c85-ddb6-48ba-bb3..._ 1/27/2016 Be 


FW: FW: Bluetooth Vulnerabities A Page 2 of 2 


The first expioit is known as "BLUESNARFING". ALTHOUGH BLUETOOTH IS WIDELY CONSIDERED A SHORT RANGE NETWORK STANDARD, THE 
EFFECTIVE RANGE OF THIS ATTACK CAN BE EXTENDED WITH HIGH GAIN ANTENNAS UP TO A MILE. 


A GREATER THREAT INVOLVES WHAT IS REFERRED TO AS A “BLUEBUG" EXPLOIT, WHERE THE ATTACKER TAKES REMOTE SERIAL ACCESS TO 
THE DEVICE AND THEREBY GAINS FULL CONSOLE CONTROL. THIS ALLOWS THE ATTACKER TO DO THE FOLLOWING: 


>» MAKE TOLL CALLS 
> CHANGE ANY AND ALL PHONEBOOK ENTRIES TO A RECORD AND FORWARD NUMBER TO MONITOR CONVERSATIONS 
> HACK/SEND SPAM EMAILS FROM A TARGET’S PHONE 


> HAVING SOMEONE'S PHONEBOOK WOULD ALLOW AN ATTACKER TO NAMEDROP AND SOCIALLY ENGINEER THE TARGET TO DISCLOSE 
SENSITIVE INFORMATION 


> TURN A PHONE INTO AN OPEN MICROPHONE BY CONFIGURING IT TO AUTOANSWER AN INCOMING CALL WITHOUT RINGING 
> LISTEN TO THE TARGET'S VOICEMAIL 


READ OR SEND TEXT MESSAGES TO OR FROM THE TARGET, RESPECTIVELY. 


‘The “BACKDOOR” attack creates a secret paired (authenticated) relationship between a target device and a rogue device, allowing trusted 
connectivity and compromising the target's local data and services. Some Biuetooth-equipped cell phones, for instance, don’t erase their lists of 


paired devices when users’ Subscriber Identity Module (SIM) cards are swapped, enabling this type of attack to be moved from one device to 
another. 


The “BLUEJACKING” technique involves abusing the bluetooth “pairing” protocol, the system by which bluetooth devices authenticate each other. 
The technique uses the first part of the process that allows the exchange to take place, and is therefore open to further abuse if the handshake 
completes and the “biuejacker” successfully pairs with the targeted device. If such a pairing occurs, then ali data on the target device becomes 
available to the initiator. This includes every mail stored on the device. 


“Serstive, 


This email is UNCLASSIFIED. 


b6 Per DOS 


Date: Tue, 9 Nov 2010 11:32:28 -0S00 


Tom: “Mull, Stephen DY <Mul State.sgov.Gov> 
To: “Mills, Cheryi D" <MilisCD@state.sgov.gov> 


UNCLASSIFIED 
Sensitive — 


SMARTClassificationData: 
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From: “Mull, Stephen D" <SBUSTATE/VCIISNPM AG/RECIPIENTS/MULLSD> 


Sent: 7/7/2010 12:37:35 PM +00:00 

To: b6 Per 
cc: “Abedin, Huma” <AbedinH @state.gov> b7C DOS 
Subject: RE: HRC 


See you then! : 


From 

Sent: Wednesday, July 07, 2010 08:37 AM 

To: Mull, Stephen D 

Cc: Abedin, Huma b6 Per 
Subject: Re: HRC b7C DOS 


Great, I'll swing by at 12:30 


— Original Message 
From: Mull, Stephen D 

To: 

Cc: Abedin, Huma 

Sent: Wed Jul 07 08:32:22 2010 
Subject: RE: HRC 


| am; either time works. 


anno Original Mi — 
From b6 Per 
Sent: Wednesday, July 07, 2010 08:06 AM b7C DOS 


To: Mull, Stephen D 
Cc: Abedin, Huma 
Subject: Re: HRC 


Steve are you by chance free either at 12:30, or 2pm? 


----- Original Messai 
From 

To: Mull, Stephen D 
Cc: Abedin, Huma 
Sent: Thu Jul 01 11:33:11 2010 
Subject: Re: HRC 


b6 Per 
Willdo * b7C DOS 


_—- Original Message ----- 
From: Mull, Stephen D 
| 
Cc: Abedin, Huma 


Sent: Thu Jul 01 11:29:08 2010 


HRC-1375 


Subject: RE: HRC 


surf _ nat would be great, though we should probably talk first in person before involving others. 

Just lefme know when's convenient for you when you get back. b6 Per 
b7c DOS 

—— Original Message----- 

Fro 

Sent: Thursday, July 01, 2010 09:58 AM 

To: Mull, Stephen D 

Cc: Abedin, Huma 

Subject: HRC 


Hey Steve, 


Hope you're settling in to the nicest office at HST. When we're back from Europe, I'm hoping to sit with 
you and not sure who else is relevant. HRC wants to use an electronic device we bought for her in her 
office, wants me to figure out if it's doable or what we have to do to make it doable. | don't know who 
replaced Julia Hill, but | assume they should sit in too, maybe Cindy Almodovar who | think is the best 
IRM person in the department. 


b7C DOS 


Message Headers: 
b6 Per 
b7E DOS 


: "Mull, Stephen D" <MullSD@state.gov> 
To: "Reines, Philippe |" <reinesp@state.gov> 
Cc: "Abedin, Huma" <AbedinH@state.gov> 
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PR_RIM_INTERNET_MESS b6 Per 
AGE_ID: state.sbu> b7E DOS 
PR_RIM_MSG_STATUS: 


PR_RIM_MSG_ON_DEVICE true 
3.6: 

PR_RIM_MSG_REF_ID: 1139874124 
PR_RIM_MSG_FOLDER_ID: -6 


PR_RIM_MESSAGE_SUBMI b7E Per DOS 
SSION_ID: 

PR_RIM_DELETED_BY_DE true 

VICE: 

PR_RIM_PAGER_TX_FLAG: true 
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ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 04-08-2019 BY CééW46B11 NSICG 


b3 


File Number [Pos ee Jz 
b7E 
Ficld Office Acquiring Evidence _ = 
Serial # of Originating Document S4 
i 
Date R, \ 
bé 
From b7c 
{ributor/Interviewee) ’ 
(Address) 
Wasi, DE 
(City and State) 
b6 
B b7C 
To Be Retumed () Yes &D No 
ReceiptGiven [1 Yes No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
O Yes LHONo 
Federal Taxpayer Information (FTI) 
0 Yes lo 
Mid year Eyam 
b6 
Reference: Intenicw 0 f bic 


es . = b6 
Description: Original notes re interview of 
iP b7C 


(aul 
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ALL FBI INFORMATION CONTAINED 


HEREIN IS UNCLASSIFIED 


DATE 11-21-2016 BY J76318T80 NSICG 


(cell) 


Introduction 


° 
° 
° 


° 


Voluntary / Can stop at any time 

NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 

FBI's interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. 

Witness identifiers, 3° party witnesses and affect on confidentiality 


Brief overview of duties as 
© Clearance, training, frequency of handling classified information 
Knowledge of the private server and email 


o When did you become aware that the Secretary was using a private email / server? 
o Was this consistent with DoS policy? 


© Did you ever witness the email content that you felt was particularly sensitive even if it 
wasn’t marked as classified? 
Discussion of video 


013 speech to the American Foreign Service Association 


Video quote: 


Can you provide some context to this statement? 


HRC-1380 


b6 
b7c 


b6 
b7C 


b6 
b7C 


b6é 
b7C 


© What di ean by 


o Was sensitive or classified information conducted on the system? 
= _Inthis instance or ever? 


° Wasl____Flassified? - No 


= How would this be crafted pre-BB? Why? 


© When does US strategy / policy or other diplomatic negotiations become classified 


in your mind? 


Any other thoughts / concerns regarding this matter. 
NDA request 
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b6 
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a) Cy 
FD-340 (Rev. 4-11-03) f A 43 


b7E 
Ficld Office Acquiring Evidence WF 


Serial # of Originating Document 55 
Date Received FESS _ 10, ZO 
Interviewee) b7c 
(Address) 


(City and State) 


B b6 
To Be Retumed [) Yes I No 


\ ReceiptGiven 0 Yes I No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


O Yes A No 
Federal Taxpayer Information (FTI) 
OD Yes AD No 


MIDYSAZ. SAM 


Reference: 


(Communication Enclosing Material) 


Description: b= Original notes re interview of 


[ee nea 
b7C 


(AA 


HRC-1384 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-18-2016 BY J76318T80 NSICG 


b6 
2-l0-20lu BIC | 


| U5 37 hye WY WY 


bé6 
b7c 


| bé 
b7c 
A Keadia ) _ Me nod 


4 Cent Mie < laf fo: 

| 
Infrrmai Format Mrys wo) pes . ap) 
PCM. -  Panugat Corm Meerag ¢ DCU 


(ovrdi nate paueanes | ordinate wf Crunte-pa 
Ht 


PCM few & ween o-Y¥ 
| beM— JS x weer . 


TCs omraets. TS Siiliien 


Sempre on desk 
| ~joe_Me Pant Sieg wes. 


we 


pe (3. pnames 


——|_Lneetely Iwnuig_/ pera. Zetast, | heuer 


| ; HRC-1385 


not] | posite oe x 


Arona wna finctiamng by NSO" Exeadhve Seeretant . 


—_—__——_+ 


= Knew see Subilan fiea_parc Goh. Jenlie 


HRC-1386 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 11-21-2016 BY J76318T80 NSICG 


[___ponterview Outline 


b7c 


Question Outline ca 
© Introduction er . 
© FBI's interest in the matter jw“ 
co NSLB disclaimer re: prior statements Le Vv 
o Can consult counsel if necessary (o) 4 iN 


¢ What is your current position? we us Y cod 
e Brief description of role at NSC as relative to Department of State? rae 


© Howoften did you coordinate with DoS? 2 v gt Ne 
= For what types of matters? 47) Ka - ro 
= Who were you primary contacts at DoS? + v 
= What was the nature of the communications? eas 
= How often did you send / receive documents to DoS? 7 : 


e Examples of? 
o. Classified, unclassified? 
o How were the documents transferred? 
© Email regarding PC meeting 
© October 4, 2009 email chain wit egarding content for a Restricted PC meeting on be 
October 5", 2009 regarding atoar| = fecmnenatn {| babel 
= Do you recall the Restricted Principals Committee meeting? Can you provide 
general context on who / what was involved? 
¢ Do you recall if the final product for the PC meeting was classified? 
© At what level(s)? os or 
=  EMAIL1— 
e What is being couriered and to whom? 
o Is this typical? 
What is at the Secret level? 
¢ What is the DNI stuff that you are referring to? What was it classified? 
o Where did you get it from? 
o Howcan we track it down? 
= EMAIL 2a, 2b and 3 - 
¢ What was the ‘DNI piece’ specifically? 
e Who was the originating agency? 
¢ What was the classification of the piece? 
© Where was it couriered to, DOS? How would this have been done? 
Who would have sent it / who would have it been sent to? 
= EMAIL4— 


- 
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¢ What is the standard procedure for distro of the package. Who does it 
goto? ss ca 
= EMAILS— @ ye 
© What is washfax? wl 7 
= EMAIL6- 


@ What does Tab 2 refer to specifically? 
© Isit the same as the ‘DNI piece’ referenced above? 
o What was the classification level of this doc, TS? 
= DNI piece appears to be S, as you attempted to send it 
via SIPR 
© Does NSC / EOP archive content from each PC meeting? 
= What department / who is the POC for this? 
= EMAIL7— 
e¢ Were there any follow up items? 
What would typically happen after a PC meeting with regards to specific 
policy / strategy? 
¢ How would decisions from the meeting be disseminated to relevant 
agencies? 
= EMAIL 8 & 8a — (header / footer email — tp on way forward in Afghanistan, 
Plan for PC tomorrow, meeting with Clinton and Petraeus) 
© What was the context of this email? 
¢ Do you recall what supporting information was provided by DoS 
© Classification of it? 
o. Is it maintained by NSC. 
Did you ever have concern about the transmission of sensitive / classified info on unclass, or 
non-government? 
Any other relevant information? 
NDA 
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b7c 


Professional Background 


Question Outline 
¢ Introduction 
“po FBI's interest in the matter 
pf NSLB disclaimer re: prior statements 
o Can consult counsel if necessary 
¢ What is your current position? 
¢ Brief description of role at NSC as relative to Department of State? 
© How often did you coordinate with DoS? 
= For what types of matters? 
= Who were you primary contacts at DoS? 
= What was the nature of the communications? 
= How often did you send / receive documents to DoS? 
e Examples of? 
© Classified, unclassified? 
o How were the documents transferred? 
¢ Email regarding PC meeting 
© Octaber 4, 2009 email chain wit! regarding cantent far a Restricted PC meeting an b6 
Octaber 5", 2009 regarding Af-Pak| mendatians ar bic 
= Do you recall the Restricted Principals Committee meeting? Can you provide 
general context on who / what was involved? 
¢ Do you recall if the final product for the PC meeting was classified? 
o At what level(s)? 


* EMAIL1- D ; : z ’ ; 
Ways 10 Court Dos . Whats tarteraees oh seen Asking i and ‘ 


oO Is this typical? 
Wh Fiy- froure fe be sis typical? 
wW ¥ 7 (0) ¢ What is at the Secret level? 
@ COM tr © What is tie uff that you are referring to? What was it classified? 


Oo Wheré did you get it from? 
Omni tecatt Speech © How can we track it down? 
= EMAIL 2a, 2b and 3 - 
What was the ‘DNI piece’ specifically? 


Dorit reeau © Who was the originating agency? 
Anis pan wer Pri ¢ What was the classification of the piece? 
¢ Where was it couriered to, DOS? How would this have been done? 
ascss mont - Who would have sent it / who would have it been sent to? 
=  EMAIL4— 
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e What is the standard procedure for distro of the package. Whodoesit edit 
go to? : 
"= EMAILS- fx . hoe my 
© Whats (vashfax?_ / Secure . out \ a 
ThEMAILG never Saw hecevingénd of id" 
@ What does Tab 2 refer to specifically? 0 any whore free 
o. Isit the same as the ‘DNI piece’ referenced above? Fdays bY. 
yi -o. What was the classification level of this doc, TS? Hh ny Wa 
e ye = DNI piece appears to be S, as you attempted to send it x 
ys ay 0 via SIPR 
oo ok ‘0 Does NSC / EOP archive content from each PC meeting? 


= What department / who is the POC for this? 
= EMAIL7— 
© Were there any follow up items? 
© What would typically happen after a PC meeting with regards to specific 
policy / strategy? 
¢ How would decisions from the meeting be disseminated to relevant 
agencies? 
* EMAIL 8 & 8a — (header / footer email — tp on way forward in Afghanistan, 
Z Plan for PC tomorrow, meeting with Clinton and Petraeus) 
- © What was the context of this email? 
ieee ¢ Do you recall what supporting information was provided by DoS 
go" © Classification of it? 
o Isit maintained by NSC. 
¢ Did you ever have concern about the transmission of sensitive / classified info on unclass, or 
non-government? —> Nottharl can ceca 
¢ Any other relevant information? 
e NDA 
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- RE: How's it looking? Page | of 2 


From: “Spence, Matthew b6 Per NSC 
‘Sent: 10/4/2009 1 1:06:59 PM +00:00 

To: “Sullivan, Jacob J” <SBUSTATE/SES/RECIPIENTS/SULLIVANJJ> 

Subject: RE: How's it looking? 


‘Thanks man. It's blood out of @ stone with the Holbrooke team. 


¥’m going through the DNI stuff now. It’s oretty decent, with a few exceptions. 


From: Sullivan, Jacob J [mailto:Sullivan]J@state.gov) 
‘Sent: Sunday, October 04, 2009 6:34 PM 

To: Spence, Matthew J. 

Subject: Re: Hows it looking? 


vos 


ey as b6 Per NSC 


To: Sullivan, Jacob J 
Sent: Sun Oct 04 18:29:57 2009 
‘Subject: RE: How's it looking? 


Gotcha, Another option Is for us to courier this stuff out tonight, and then email out your paper very late tonight, since It’s at the Secrat level, right? 


From: Sullivan, Jacob J (mailto: SullvanJ9@state.gov) 
Sent: Sunday, October 04, 2009 6:27 PM 

To: Spence, Matthew J. 

Subject: Re: How's it looking? 


Moving 09 {081 as possible. 


To: Sullivan, Jacob J 


‘Sent: Sun Oct 04 18:20:27 2009 
‘Subject: How's it looking? 


b6 Per NSC 


Matt Spence 


tional Security Councit 


b6 Per 
Microsoft Mail Internet Headers Version 2.0 b7E DOS. 


Received: tom{ Jette sou-————Tov[ tate. sbu wit microsot 


‘Sun, 4 Oct 2009 19:07:16 -0400 
‘Sun, 4 Oct 2009 19:07:16 -0400 
Received: (00 Ooo L___]" state.sbu with 1 
Received eS | a w 
‘Sun, 4 Oct DOT TOTS Oa 
jicrosoft| 
Sun, 4 Oct 2009 19:07:15 ~ 
Received: from es9e0p01..eo9.goy (mailhub- 918.137.241.411) 
for <SullivanJJ@state.gov>; Sun, 4 Oct 2009 18:52:33 -0400 
Received: from esgeop01.eop.gov ({198.137.241.41]) bTE DOS 
for <SullivanJJ@state.gov>; Sun, 04 Oct 2009 23:14:24 +! 
Received: from. 102, eop.gov by esgeop01.e0p.gor for <SuliivanJJ@state.gov>; Sun, 4 Oc 
X-SENDER-IP: 
content-class: urn:content-classes:message 
MIME-Version: 1.0 


Received: ‘romf{——————Jstare.soof____——_ov[_Istate ssbu with Microsoft 
‘Sun, 4 Oct OF: 16 

neces om sganz ste goof Jov te 
ty sUmnsond. pate. gov win b6 Per 
by Stimson-1.state.gov 

X-SENDER-REPUTATION: None 

Content-Type: multipart/alternative; 


X-MimeOLE: Produced By Microsoft Exchange V6.0.6619.12 
‘Subject: RE: How's it looking? 


HRC-1392 
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~ RE: How's it looking? Page 2 of 2 


Date: Sun, 4 Oct 2009 19:06:59 -0400 
Message-ID: <891044DBD 1E2C94EBE988E74EE0C221601 3B61CO@SMEOP 1BEVS.eopds.eop.gov> b6 Per 
X-MS-Has-Attach: 

X-MS-TNEF-Correlator: bTE DOS 
Thread-Topic: How's it looking? 
‘Thread-Index; 
References; rate sbu> 
From: "Spel 


To: "Sullivan, Jacob 3” <SullwanJI@state.gov> 

X-OriginalArrivalTime: 04 Oct 2009 23:06:59. C7 b6 Per NSC 
Return-Path: prvs=52178/90¢: 

X-TM-AS-Product-Ver 
X-TM-AS-Result 
X-TM-AS-User-Approved Sender 
X-TM-AS-User-Blocked-Sender: No 


Content-Type r 
charset 
Content-TransTer Encoding: base64 


b6 Per 
b7E DOS 


PR_RIM_INTERNET_MESSAGE_ID: “<891D44D80 162094 BE98BE7 4EE0C22 1601386 1CO@SMEOP 18EVS. eopds.eop.gov> 
PR_RIM_PAGER_TX_FLAG: te 

PR_RIM_MSG_FOLDER_ID: 3 

PR_RIM_DELETED_BY_DEVICE: tue 

PR_RIM_MSG_REF_ID: 2021940588 

PR_RIM_MSG_STATUS: 1 

PR_RIM_MSG_ON_DEVICE_3_6: we 
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Just sent you the DNI piece on SIPR Page | of 1 


b6 Per NSC 


“Spence, Matthew J 

10/5/2009 12:46:30 AM +0000 

“Sullivan, Jacob J” <SBUSTATE/SES/RECIPIENTS/SULLIVANJJ> 
Just sent you the DNI piece on SIPR 


Matt Spence 
National Security Council 
(202) 456.9481, 


b6 Per 
b7E DOS 


Cc 


Sun, 4 0 aS ODD 
Received: trom stimsonz.state.gov[ —__] —— sbu with microsott[___] 


Sun, 4 Oct 2009 20:46:37 -0: 


Received: from esgcop01.eop.gov (mailhub-cop3. .137.241.41)) 
by stimson2.state.gov wit 
for <SultivonJ@stote.gov>; Sun, ret FSZ-04-0400 


Received: from esgeop01.e0p.gov ({198.137.241.41]) 
by Stimson-1.state.gov 


for <Sullivan)J@state.gov>; Mon, 0S Oct 2009 00:53: 
Received: frot 1P.gOv by esgeop0}.e0p.g for <Sullivan))@state.gov>; Sun, 4 0 
X+SENDER-IP:| 


X-SENDER-REPUTATION: None 
content-class: urn:cantent-classes:message 
MIME-Version: 1.0 

Cont 


‘Message Headers: 


X-MimeOLe: Produced By Microsoft Exchangi 
Subject: Just sent you the DNI piece on SIPR 


Date: Sun, 4 Oct 2009 20:46:30 -0400 b6 Per 
Message-ID: <891044D8D1E2C94EBE988E74EE0C2216013B61CF@SMEDPIBEVS.eopds.eop.gov> 
X-MS-Has-Attach: b7E DOS 


X-MS-TNEF-Correlator: 
‘Thread-Topic: Just sent 


To: "Sullivan, Jacob J" <Sulllwam 
X-OriginalArrivalTime: 05 Oct 2 
Return-Path: prvs=52 


istate.gov> 
ort 


a b6 Per NSC 


X-TM-AS-User-Approved-Sender” NO" 
X-TM-AS-User-Blocked-Sender: No 


Content-Transferencoding: quoted-printable 


meee oe texU RENT 
crarset-f 
Content-Transfer-Encoding: quoted-printable 


PR_RIM_INTERNET_MESSAGE_IO: ~<BSTD44DB0 1E2C94E DESSBET AEEOC 2216013861 CF@SMEOP 18EVS.eopds.eop.gov> 
PR_RIM_PAGER_TX_FLAG: two 

PR_RIM_MSG_FOLDER_ID: 3 

PR_RIM_DELETED_BY_DEWICE: tue 

PR_RIM_MSG_REF_IO: -1375815399 

PR_RIM_MSG_STATUS: 1 

PR_RIM_MSG_ON_DEVICE_3_6: true 
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State paper Page | of | 


a " 
| 


From: "Spence, Matthew J. 


‘Sent: 10/5/2009 11:35:36 AM +00:00 o b6 Per NSC 
To: “Sullivan, Jacob J” <SBUSTATE/SES/RECIPIENTS/SULLIVANJJ> 

Subject: State paper 

Hey man - 


Sorry to sound like a broken record, but know when you all could shoot that paper over? 


T also saw that the ONI thing I sent on SIPR didn’t go through for some reason. But the package was couriered over, so you all should have it by now. 


‘Matt Spence 


National Security Councit 


(202) 456.9481 


Message Headers: Microsoft Mail 


internet Headers Version 
Received: from Ftate.sbu > Fratesbu with microson| ______] 


Mon, 5 Oct 2009 07:35:44 -0400 
Received: from[ ——state.sbu tate.sbu with Microsof{_____]b6 Per 


Received: tromf states ————dtovE tate bu win B7E DOS 
Mon, 5 01 2 


Received: from 


=e 
Mon, 5 Oct 2009 07:35:44 -041 
Mon, 5 Oct 2009 07:35:43 ~ 


Received: from esgeop01.cop.gov (mailhyb-. 137.241.41}) 
by stimson3.state.gov wit! 
for <Sullivand}@state.gov>; Mon, 5 Oct 17:25:48 -0400 


Received: from esgeop01.eop.gov ({198.137.241.41}). 
by Stimson-2.state.gov 


for <Sullivan}J@state.gov>; Mon, OS Oct 2009 11:45:18 + b6 Per 
Received: (ror es050002.600.90% by esgeop01.eop.go for <SullivandJ@state.gov>; Mon, 5 Oc 

X-SENDER-IP: b7E DOS 
X-SENDER-REPUTATION: None 

content-class: urn:content-classes:message 

MIME-Version: 1.0 


Content bc 
X-MimeOLE: Produced By Microsoft Exchange| 


‘Subject: State paper 
Date: Mon, 5 Oct 2009 07:35:36 -0400 

Message-ID: <891044D80 1E2C94EBE9B8E74EE0C221 601 386 1DB@SMEOP 1 BEVS. copds.eop.gov> 
X-MS-Has-Attach: 

X-MS-TNEF-Correlator: 

Thread-Topic: 
Index: 
b6 Per NSC 


X-TM-AS-User-Approv 
X-TM-AS-User-Biocked-Sender: No b6 Per 


b7E DOS 
Tontent Typer 


charset: 
Content-Transfer-Encoding: quoted-printable 


a= ay 


charset: 
Content-Transfer-Encoding: quoted-printable 


PR_RIM_INTERNET_MESSAGE_1D: <891044DB01E2C94EBESBBE7 4EE0C22 1601386 1D8@SMEOP 18EVS.copds.eop.gov> 
PR_RIM_PAGER_TX_FLAG: truo 

PR_RIM_MSG_FOLOER_0: 3 

PR_RIM_DELETED_BY_DEVICE: true 

PR_RIM_MSG_REF_ID: “1680938066 

PR_RIM_MSG_STATUS: 1 

PR_RIM_MSG_ON_DEVICE_3_6: true 
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From: “Spence, Matthew = b6 Per NSC 
Sent: 10/4/2009 11:53:27 

To: “Sulivan, Jacob J" <SBUSTATE/SESIRECIPIENTS/SULLIVANJJ> 

Subject: RE: Hows it looking? 

Gotcha, 


4m gonna send thie out now, but you'd neip your cause a lot with Tom if you could have something that he can read when he walks in tomorrow morning (which 1 
could read first), 


‘Tha ONE assessment is actually pretty lame and doesn’t help. But it’s secret, so I'll send it to you on SIPR. 


From: Sullivan, Jacob J {maiito:Sulivan})@state.gov) 
‘Sent: Sunday, October 04, 2009 7:37 PM 

‘To: Spence, Matthew J. 

‘Subject: RE: How's it looking? 


Thip In Lough, but part of It is S engagement. She wants to see final and edit before it goes. 
frome Spence, Matte .(masto[ b6 Per NSC 
Sent: Sunday, October 04, 2009 7 


To: Sullivan, Jacob } 
‘Subject: RE: How's it looking? 


‘Thanks Man, It’s blood out of @ stone with the Holbrooke team. 


Vm going through tha ONI stuff now. It’s pretty decent, with a few exceptions. 


From: Sullivan, Jacob ) {mailto:Sullivand)@state.gov) 
Sent: Sunday, October 04, 2009 6:34 PM 

“To: Spence, Matthew J. 
‘Subject: Re: How's it looking? 


Yas 


From: Spence, Matthew 


_) b6 Per NSC 
To: Sullivan, Jacob } 


‘Sent: Sun Oct 04 18:29:57 2009 
‘Subject: RE: How's it looking? 


Gotcha, Another option is for us to courier this stuff out tonight, and then email out your paper very late tonight, since It's at the Secret level, right? 


From: Sulivan, Jacob } {mailto:Sulivand3@state gov] 
Sent: Sunday, October 04, 2009 6:27 PM ’ 
To: Spence, Matthew J. 

‘Subject: Re: How's it looking? 


Moving a6 fast a9 possibie, 


From: Spence, mattew [= : b6 Per NSC 
To: Sullivan, Jacob J 


‘Sent: Sun Oct 04 18:20:27 2009 
Subject: How's it looking? 


Matt Spence 


HRC-1396 
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——$—$_$_—_—$$$ 


From: “Spence, Matthew J. b6 Per NSC 
Sent: 10/4/2009 11:06:30 PM +00:00 

To: “Jones, Paul W"<SBUSTATE/MANILA AG/RECIPIENTS/JONESPW2>; "Sullivan, Jacob J” <SBUSTATE/SES/RECIPIENTS/SULLIVANJJ> 

ce: “Tien, John K.| ["Lebson. Eric M.| 

Subject: RE: How's it looking? 


‘The folks here have asked you to send It here, and we'll do the distro with the package. It'll come on SIPR? Can you send a draft here, which we won't distro 
beyond the few folks working on it here? 


Looping In our folks handing this. 


From: Jones, Paul W [mailto:JonesPW2@state. gov] 
‘Sent: Sunday, October 04, 2009 6:45 PM 

To: Sullivan, Jacob J; Spence, Matthew J. 

‘Subject: RE: How's it looking? 


It is nat ready for distro ~stlll © number of items. 1 think we need to email late tonight. Just let me know the address(es) 


Jake, 
‘We can provide o draft now for &, if needed. 


From: Sullivan, Jacob 2 
‘Sent: Sunday, October 04, 2009 6:36 PM 

To Jones, Paul W b6 Per NSC 
sul 


‘Adding Poul, Paul what's our ETA? 


trom space nanee[ 
To: Sullivan, Jacob J 


‘Sent: Sun Oct 04 18:29:57 2009 
‘Subject: RE: How's it looking? 


Gotcha. Another option Is for us to courier this stuff out tonight, and then email out your paper very I: 


@ tonight, since it’s at the Secret level, right? 


From: Sullivan, Jacob } [mailto:SullivanJI@state.gov) 
Sent: Sunday, October 04, 2009 6:27 PM 

To: Spence, Matthew J. 

Subject: Re: How's it looking? 


Moving as fast as passibio, 


a 


To: Sullivan, Jacob ) 
‘Sent: Sun Oct 04 18:20:27 2009 
Subject: How's it looking? 


b6 Per NSC 
Mau Spence 
National Security Council 
b6 Per 
bIE DOS 


Message Headers: Microsoft Mail Internet Headers Version 2.0 


Sun, 4 Oct 2009 19:06:37 -041 

Received: | a re a sbu with Microsor]_ 
Sun, 4 

Received: from Jstatestuf_ Joy ]state.sbu with micre 


‘Sun, 4 Oct 2009 19:06:37 “0400 
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Checking in 


Page | of | 


SSS 
| 


From: "Spence, Matthew J 
Sent: 10/5/2009 9:44:10 PM +00.00 
To: “Sullivan, Jacob J” <SBUSTATE/SES/RECIPIENTS/SULLIVANJJ> : 
Subject Checking in 
b6 Per NSC 
Hey man - Let me sort out the follow-ups from this mtg, then give you a calll to check in on all of thi 
> Matt Spence 
National Security Council 
~~ b6 Per 


Message Headers: 


PR_RIM_INTERNET_MESSAGE_1D: 
PR_RIM_PAGER_TX_FLAG: 
PR_RIM_MSG_FOLDER_D: 
PR_RIM_DELETED_BY_DEVICE: 
PR_RIM_MSG_REF_ID: 
PR_RIM_MSG_STATUS: 
PR_RIM_MSG_ON_DEVICE_3_6: 


Microsoft Mail Internet Headers Vers 
Received: from| tate.sbi 


in 


Ey attest with nieces TE. DOS 
statesbof ov rate sbu with mirosor 
Mon, S Oct 2009 17:44:27 -O4 
Receives! from stimson3 state Ss es su with wicrsot{—] 
Mon, 5 Oct 2009 17:44:27 ~ 
Received: from esgeop01.e0p.gov (mailhub- wv 137.241.41)) 
by stimson3.state.gov with 
for <Sullivan)J@state.gov>; Mon, 5 Oct 2009 17:38:32 -0400 
Received: from esgeop0! .eop.gov ((198. 137.241.41}) 
by Stimson-2.state.gov 


for <Sullivant)@state.gov>; Mon, OS Oct 2009 21:54:02 +0000 
Received: from. — gov by esgeop01.e0p.gov id n9SLINIGO09496 for <SullivanJJ@state.gov>; Mon, 5 Oct 


X-SENDER-IP. Per 
X-SENDER-RE! None me 
content-class: urn:content-classes:message b7E DOS 
MIME-Version: 1.0 


Content-Type: multi a 
X-MimeOLE: Produced By Microsoft Exchang 


‘Subject: Checking in 

Date: Mon, 5 Oct 2009 17:44:10 -0400 

Message-ID: <8910440B01 E2C94EBE988E74EE0C22 1601386 1EE@SMEOPIBEVS.eopds. 20p.gov> 

X-MS-Has-Attach: 

X-MS-TNEF-Correlator: b6 Per 


Thread-Topic: b7E DOS 


X-TM-AS-Produ 
X-TM-AS-Result| 
X-TM-AS-User-Approved-Sender: No 
X-TM-AS-User-Blocked-Sender: No 


b6 Per NSC 


Tontent- Type; r 
charset: 
Content-Transfer-Encoding: quoted-printable 


ET YP ee q b6 Per 
charset 


Ss 
Content-Transfer-Encoding: quoted-printable BiB Do 


<B91DSaDBD 1204 BEIBSET AEE0C22 16013851 EE@SMEOP 18EVS.copds eop.gov> 
tue 

3 

true 

-1882870175 

1 

te 
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— 


om: "McClure, Kimberly M" <SBUSTATE/SES/RECIPIENTS/MCCLUREKM> 
ant: 10/5/2009 12:20:00 PM +00:00 

B “Jones, Paul W" <JonesPW2@state.gov>; “Sullivan, Jacob J" 
<SullivanJJ@state.gov> 

PH SSRAP_StaffAssistants <SSRAP_StaffAssistants@state.gov> 

tbject: RE: Materials for wh 


e just talked to Matt Spence. We're having it washfaxed now. 


--Original Message----- 

om: Jones, Paul W 

int. Monday, October 05, 2009 8:09 AM 
«. Sullivan, Jacob J; McClure, Kimberly M 
ibject: RE: Materials for wh 


2-emailed and Kim will follow up to ensure they received. If not, we will washfax. 


--Original Message----- 

om: Sullivan, Jacob J 

ant: Monday, October 05, 2009 8:04 AM 

x Jones, Paul W; LaVine, Christopher M; Beale, Courtney A Kramer 
Ibject: Materials for wh 


hite House is having email probs so can you guys washfax and re-email to wh folks? 


_RIM_INTERNET_MESS 
3E_ID: 


State.sbu> 
2RIM_PAGER_TX_FLAG: true 


%_LRIM_MSG_FOLDER_ID: -3 


<_LRIM_DELETED_BY_DE true 

CE: 

<_RIM_MESSAGE_SUBMI 

3ION_ID: 

%_RIM_MSG_REF_ID: -1837087385 
%_RIM_MSG_STATUS: 1 
*_RIM_MSG_ON_DEVICE | true 
6: 


b6 Per 
b7E DOS 


b6 Per 
b7E DOS 
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From: "Toiv, Nora F" <CLASSSTATE/SES AG/RECIPIENTS/TOIVNF> 
Sent: 10/5/2009 12:35:25 PM +00:00 

To: “Mills, Chery! D” <MillsCD@state.sgov.gov> 

Subject: FW: FW: Final Pak Memo w/ attachments 

Attachments: Tab 7 - Proposed Signature Assistance Program.pptx; Tab 1 - Riedel 


Objectives.docx; Tab 3 - Pakistan's Support for Taliban and Terrorism - 
FINAL.docx; Tab 4 - Security Assistance Proposal.pptx; Tab 5 - Stablizing 
Pakistan.docx; Tab 6 - Current US Civilian Assistance.docx; Tab 8 - 
PakistanStrategy Abbreviated version.pptx; Tab 10 - Alternative 
Approaches.docx; Tab 9 - Intl Support for Pakistan.docx; MEMO - U S interests 
in Pak Paper 10-04 pdf; 09-10-5 SEC-JONES MEMO on PAK. pdf 


From: Beale, Courtney A 

Sent: Monday, October 05, 2009 8:31 AM 

To: Toiv, Nora F; Laszczych, Joanne 

Cc: S_SpecialAssistants 

Subject: FW: Final Pak Memo w/ attachments 
Importance: High 


From: McClure, Kimberly MOn Behalf Of SSRAP StaffAssistants 
Sent: Monday, October 05, 2009 8:18 AM 

To: S_SpecialAssistants 

Cc: SSRAP_StaffAssistants 

Subject: FW: Final Pak Memo w/ attachments 

Importance: High 


Courtney, Zia, Dan - 


I just wanted to make sure a copy of this had made its way to you as well. This is for today’s 
restricted PC on Af-Pak. 


Kim McClure 
Special Assistant 


Office of the Special Representative for Afghanistan and Pakistan 


HRC-1400 
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202-647-4134 


From: McClure, Kimberly MOn Behalf Of SSRAP StaffAssistants 
Sent: Monday, October 05, 2009 8:15 AM 

To: Dubose, Mary L 

Cc: D(L); SSRAP_StaffAssistants 

Subject: FW: Final Pak Memo w/ attachments 

Importance: High 


Mary, 


Here Is the package for today’s NSC meeting (there is no Tab 2, as it is a TS doc that will be 
Provided by ODNI). Please note that an Annotated Agenda was submitted to the Line on Friday. 
They will have the latest version of that document. 


Kim McClure 

Special Assistant 

Office of the Special Representative for Afghanistan and Pakistan 
202-647-4134 


From: Jones, Paul W 

Sent: Monday, October 05, 2009 4:09 AM 

To: Spence, Matthew; Sullivan, Jacob J; 'Kobs, David M.'; ‘Tien, John K. Jr.'; ‘Lute, Douglas E.'; Lebson, Eric 
CIV OSD POLICY; Chollet, Derek H 

Cc: SSRAP_StaffAssistants 

Subject: FW: Final Pak Memo w/ attachments 

Importance: High 


Dear NSC colleagues, 


Pls find attached a cover memo from Secretary Clinton, the State Dept memo U.S. interests In 
Pakistan, and ten tabs, for the Principals meeting on Tuesday afternoon. We would appreciate 
your circulating these materials to attendees at the Principals committee meeting. 


Note 2- Tab 2 to be provided by ODNI. 
Best regards, 


HRC-1401 
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Paul 
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UNCLASSIFIED U.S. Department of State Case No. F-2014-20439 Doc No. C05781399 Date: 01/07/2016 


[RELEASE IN PART B5,B6] 
From: Sullivan, Jacob J <SullivanJJ@state.gov> 
Sent: Friday, June 17, 2011 8:18 AM 
To: H 


Subject: Re! BS 


They say they've had issues sending secure fax. They're working on it. 


From: Sullivan, Jacob ) 
Sent: Friday, June 17, 2011 08:00 AM 


21! Checking 


From: H [malito: HDR22@clintonemail.com] 
Sent: Friday, June 17,2011 07:52 AM 

To: Sullivan, Jacob J 

Subject: Re: 


I didn't get the TPs yet. 


From: | Sullivan, Jacob J [mailto:SulllvanJJ@state.gov} 
Sent: Thursday, June 16, 2011 05:51 PM 
To: H 


You'll get tps this eve. They're coming together. 


Sent: Thursday, June 16, 2011 04: 15 i 


To: Sulliyan_JacobJ____ . 
Subject; BS 


| aE RES eae 


UNCLASSIFIED U.S. Department of State Case No. F-2014-20439 Doc No. C05781399 Date: 01/07/2016 HRC-1403 


B6 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 04-03-2019 BY CééW46B11 NSICG 


) 
[at 

FD-340 (Rev. 4-11-03) 

- 29 b3 
File Number 322 b7E 
Ficld Office Acquiring Evidence WF 
Serial # of Originating Document os SG ee 
Date Received 2-(6° ZO0ly 

b6 

From b7C 


(Name of Contributor Interviewee) 


(Address) 
—_—_—Wushngtm De 
(City and State) 


b6 
By b7C 


To Be Retumed [1] Yes No 


ReceiptGiven © Yes No 
Grand Jury Material - Disseminate Only Pursudnt to Rule 6 (e) 
Federal Rules of Criminal Procedure 


DO Yes G0vo 
oe 


Federal Taxpayer Information (FTI) 
OD Yes 


lo 


Midyear Eyam 


| | : b6 
Reference: NGS fom Mig iG eae 


(Communication Enclosing Material) 


Description: ) Original notes re interview of| : —-— b6 
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bl Per CIA 
{S}—b6 Per FBI— 
b7C Per FBI 
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ALL FBI INFORMATION CONTAINED SESRET_ [= 1 bé 
HEREIN IS UNCLASSIFIED b7c 


DATE 11-21-2016 BY J76318T80 NSICG 
. a b6é 
Interview Outlin 
[} eine. b7c 
Professional Background 


Founder and Managing Directo’ 


e Various roles o: 


Educational Backgroun 
. 


b6 


b7c 
. 


fo 


ara 
roe oe bl Per CIA 


of 
es b3 Per CIA 
0 b6 Per FBI 


Clow g b7C Per FBI 
| A (5) 
US) prdicatn 


relative to Department of State? 
o How often did you inate with DoS? 


uestion Outline 
e Introduction 
o FBI's interest in the matter 
co NSLB disclaimer re: prior stateme 
o Can consult counsel if necess; 
© What is your current posit) 


au levee ant 


WN io) = For what type of matters? A me Time 
raat @. \ we O4 = Who were you primary contacts at DoS wile a —ids Wee 4: 
¢ Ww . = What was the nature of the communications? (in person, email, telephone) av) . 
ub = How often did you send / receive documents to DoS? Mille 
Ww e Examples of? abi; VN 6 
yt . 0 Classified, unclassified? Sadi b7c 
ay o How were the documents transferred? * 
to nO * Did you ever email directly with Secretary Clinton? Amp. 0604 fenerdy 
ae. wy = Were you aware of Secretary Clinton’s use of a private email address? Private 
Ye x server? b6 
Res ~~ = Did Lever acknowledge to you he was aware Secretary Clinton was using b7C 
ae) So a ( i a private, haces account? —, ever cmtae HR duicue ? 
START of emails duri rence. Comin HCE. direst how! was ac dime ? b3 Per CIA 


—<—.. ~b6 Per FBI 


| (éwe7e Per FBI 


© Email#1{____](March 21, 2009) 


Unclass came up. 
Mostly wone mm _ 
ire - Jere FP: 
eb (G .- TS or 

tae 


eooo0o°0o 


Was it common practice to se 
Hhuakr dowiload¢ : 
NC Ady ear 


weelty Jwnun Ww| 
, Dol See . Sa 


“Bicre x HRC-1410 ty, 


Cote - = 


if opel 
ge 

yy weve cot Hine ea 
© Email eo : 2009) fron{___to Secytary Clinton referencing call wit{____] Ee 

o Doyou recall how the call referenced in the email wit as conducted? 

(secure/unsecure) Assume “open line” means unclass? lati Prow 
os’ _ © Reason for call being on an open line? 
ey Ry oO Reference “details are thin and couldn’t get into more detail on an open line... 
S\ 


KS Where/How do you draw the line between what can be discussed on an open line vs. 3 Per CIA 
: move to a classified venue? 
e p> en © Were you aware or did you assumd___ would forward the information on to the 
yw Nod Secretary? 
ye « = Were you aware he would email the information? Unclass? From Gmail 
NS Account? b3 Per CIA 


b6 Per CIA, FBI 


© Email #3 Email” (February 10, 2010) PIC wer EEL 
° was this the unclassified account you primarily used for work 
purposes? 


. untif{___] —> Wore tmai( notaveclatoly 
. starting on[_ ag wl Wauace LT Jemma 
© Email #4: C)n Israel” (November 20, 2010) b3 Per CIA 


b6 Per FBI 


This was sent from Gmail to Sullivan via Gmail... iC Bax! PEt 


=. Can you recall why you emailed via Gmail at the time? 
= Common practice in regards to Sullivan? Instructions to do so for this instance? 
= When would you email Sullivan via Gmail vs. DoS account? 


START of emails related tq___ ] TENURE... as 


e Email #5: “Libya” (Dated September 11, 2012) — B5 Redaction 


© Source of the information a conversation between] ian the Joint pe: 


Staff? Cmsuttehor Bie 


= Any official documentation of conversation? 
* Classification of material? 


e = Email #6: “This am Green e” (October 13, 2012) — B1 Redaction aa bl Per CIA 
o Explain email? . a b6 Per FBI 
Recipients? ie b7C Per FBI 


o0o°0 


Des: ee 
= Circumstances? {| 
- ig b7c 
Gai Jeuat o] we 
vgacced uf HRC-1411 


SESRET 


SECRET 


Did you ever have concern regarding the transmission of sensitive / classified info on unclass, or 
non-government, systems? 

Any other relevant information? 

NDA 


HRC-1412 


b6 Per 


b7c DOS 
————————————————_— ——_—_— 


Sent: Saturday, March 21, 2009 2:58 PM 
To: H 

Ce: Huma Abedin 

Subject: 


b3 Per DOS, CIA 


| think you know that my close friend Jeremy Bash is now Panetta's Chief of Staff at CIA. 


Hitt 


HRC-1413 ©) 


Sent: Wednesday, December 30, 2009 12:52 PM bie Dos 
To: H 

Cc: CDM; Huma Abedin; Jake Sullivan 

Subject: CIA 


Separate from what's happening in regards to the Christmas attack, Jeremy Bash just called me because Director 
Panetta wanted him to relay through me that the CIA suffered a terrible incident yesterday in Afghanistan. 


Seven of their agents were meeting with a contact when an explosion killed them all. To the extent it's currently being 
reported, they are being identified as DoD personnel, not Agency. 


The details are thin and he couldn't get into more detail on an open line, but they believe the contact they met with set 
them up and was either carrying the explosive or detonated it. 


They believe this is the greatest loss of life to a single incident in the Agency's history, and the first time that Agency 
personnel have been so deliberately targeted in Afghanistan. 


Director Panetta's at home in Monterey, CA, and likely returning to DC in the coming days. 


HRC-1414 


b6 Per 


Sent: 2/10/2010 12:17:53 AM +00:00 
To: “Sullivan, Jacob J" <SullivanJJ@state.gov> 
Subject: Re: Bash email 


That's what he uses 


From: Sullivan, Jacob J 

to[____] He Per 
Sent: Tue Feb 09 19:16:28 2010 mIC.POR 
Subject: Re: Bash email 


Work email? 
bs Sullivan, Jacob J b6 Per DOS, CIA 


Sent: Tue Feb 09 18:31:51 2010 b7C Per DOS 


Subject: Re: Bash email 


| 


oe 


ro . b6 Per 
Sent: Tue Feb 09 16:30:13 2010 Bmci008 
Subject: Bash email 
Can you send me Jeremy’s email? 
Rete ce Lash n wy ig a aay eye OT Microsoft Mail Internet Headers Version 2,0 
Message Headers: Received: from state.sbu 
Tue, 9 Feb 2010 19:17:53 -0500 
Received: from) state.sbi 
ue, 17:53 - 
Received: from state.sbu 
Microso bk pas 
Tue, 9 Feb 2010 19:17:52 -0500 bre Dos 
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Obtained by Judicial Watch, Inc. Via FOIA / S- Lil-vec 5 


t Just tried you cn the phone but you were all in with S. 


Dempsey, General Ham and the Joint Staff, we have identified the fo 


in 


After consulting with General 
cou} Q Aiki 


Assuming Principals agree to deploy these elements, we will ask State to secure t! oval from hast 
nn ele SR, | 


Jeremy 


2 


15-LR-0002 (Judicial Watch_K. Bailey)/DOS/000001 
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UNCLASSIFIED U.S. Department of State Case No. F-2014-20439 Doc No. C05792626 Date: 01/29/2016 


RELEASE IN PART 
B 


4(D), (C),BE 
From: Mills, Chery! D <MillsCD@state.gov> 
Sent: Saturday, October 13, 2012 10:11 AM 
To: H 
Subject: Fw: This am Green on Blue 


Classified by DAS, A/GIS, DoS on 01/29/2016 ~ 
(Class: SECRET ~ Reason: 1.4(C), 1.4(D) ~ Declassify 
jon: 10/12/2027 


—-- Original Message ----- 

From: Reines, Philippe | 

Sent: Saturday, October 13, 2012 09:53 AM 
To: Mills, Cheryl D; Sullivan, Jacob J 
Subject: Fw: This am Green on Blue 


- Original Message -—-- . 

From: Bash, Jeremy CIV SD [mailto: ) B6 
Sent: Saturday, October 13, 2012 09:45 AM 

To: Little, George CIVOSD PA<g_———~—~—=#& Reine, Philippe! 

Cc: Kelly, John LtGen SD {> Waldhauser, Thomas LtGen SD Cn 2 


Subject: This am Green on Blue 


As you'll be hearing from ISAF, an Afghan NDS officer pulled the ripcord on a vest in front of coalition guys loading a 
helicopter. Total of 14 either killed or wounded -- some US, some Afghans. 


Right now, we think 1 US mil killed and one wounded. 


1.4(C) 
1.4(D) 
B1 


George, please lash up with| 


B6 
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HEREIN IS UNCLASSIFIED 
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ee: FEB 4 2016, 5:00 AM ET 


linton Emails Held Indirect References to Undercover 
CIA Officers 


by KEN DILANIAN 
A handful of emails forwarded to Hillary Clinton's personal server while she was secretary of state 
contained references to undercover CIA officers — including one who was killed by a suicide attack 
in Afghanistan, according to U.S. officials who have reviewed them 


318T80 NSICG 


But contrary to some published reports, three officials said there was no email on Clinton's server 
that directly revealed the identity of an undercover intelligence operative. Rather, they said, State 
Department and other officials attempted to make veiled references to intelligence officers in the 
emails — references that were deemed classified when the messages were being reviewed years 
later for public release. 


In one case, an official said, an undercover CIA 
officer was referred to as a State Department 
official with the word "State," in quotes, as if to 
suggest the emailer knew the officer was not 
actually a diplomat. In another case, an email 
refers to "OGA" for “other government agency," 
a common reference to the CIA. Yet another 
now-classified email chain originated with a 
member of the CIA director's staff, leading 


Hillary Clinton takes a question at a rally in New Hampshire on some officials to question how Clinton could be 
Feb. 3, 2016. ADREES LATIF / Reuters blamed 


Related: Judge Sets Hearing Date in Clinton Email Case 


Clinton campaign spokesman Brian Fallon said no intelligence officer had been identified in the 
emails, and that misleading details from the emails were being leaked to hurt the candidate. 


"This shows yet again how the leaking of selective details gives a completely false impression about 
what is actually contained in the emails forwarded to Hillary Clinton," said Fallon. "Whenever the full 
contents of these emails are learned, there is invariably less than meets the eye." 


Twenty-two of the emails were fully withheld from public release last week on the grounds that the 

information in them is "Top Secret," meaning its disclosure now would cause "exceptionally grave 

damage to the national security." But intelligence officials and congressional officials who oversee 
ri are divided over whether that is actually the case. 


HRC-1419 
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“ nbenews.com Page 2 of 5 


Nonetheless, the issue promises to dog Clinton's presidential campaign. Since the messages are 
Or people with the clearances to see them are free to characterize them as they wish. 
‘epublicans tend to see them as highly problematic for Clinton, while Democrats see the opposite. 
The FBI is investigating the security of Clinton's email arrangement, and the FBI would also have 
jurisdiction to investigate the mishandling of classified information. 


Sen. Marco Rubio, the Florida Republican running for president, serves on the Senate Intelligence 
Committee. "If someone on my staff did what she did...they would be fired and they would be 
prosecuted," he said recently. 


But Rep. Adam Schiff of California, a Clinton supporter who is the ranking Democrat on the House 
Intelligence Committee, offered a different view after reading the emails. 


"The determination that something is top secret, for many people connotes that these are the most 
closely held secrets, that their revelation would be extremely damaging," he said. "There are 
potentially programs that are talked about all the time in the press that fit within that category." 


Schiff may have been referring to CIA drone 


strikes, which officials have said are ' "WHENEVER THE FULL 
discussed in the now-classified emails. The CONTENTS OF TH ESE 
strikes are highly classified but are also ' EMAILS ARE LEARNED, 


idely discussed over unclassified channels’ THERE IS INVARIABLY 
in Washington and elsewhere. LESS THAN MEETS THE 
EYE’ 


The email message about the dead officer 
was created by a Defense Department 
official, Jeremy Bash, who at the time was chief of staff to then-Defense Secretary Leon Panetta. It 
concerned Dario Lorenzetti, a Fort Worth native — later revealed to be a CIA officer — who died Oct. 
13, 2012, when an Afghan intelligence operative detonated a suicide vest in a so-called "Green on 
Blue" attack. The email was sent on the day of the attack after Lorenzetti’s death was confirmed. 


Lorenzetti's association with the CIA was leaked by anonymous officials to reporters four days after 
his death and widely reported in the news media, though his CIA cover was not lifted until later. 
Some of his obituaries listed him as a State Department officer. 


“As you'll be hearing," the Bash email begins, “an Afghan (intelligence) officer pulled the ripcord on a 
vest in front of coalition guys loading a helicopter. Total of 14 either killed or wounded — some U.S., 
some Afghans. Right now we think one U.S. mil killed and one wounded." 
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U.S. Democratic presidential candidate Hillary Clinton speaks as her husband former President Bill Clinton and their daughter 
eo. accompany her at a campaign rally in Des Moines, lowa January 31, 2016. BRIAN SNYDER / Reuters 


| 


The next paragraph of the email, which was released Friday and is now posted on the State 
Department's website, has been whited out and classified "Secret." Officials who have reviewed the 
uncensored version say Bash was attempting to preserve the CIA officer's cover. But some of the 
language he used, now that Lorenzetti is known to have been a CIA officer, could be read as a U.S. 
government acknowledgement that CIA officers pose as State Department personnel in a specific 
country, Afghanistan — something widely known but not formally admitted. Therefore, the section of 
the email was classified and blocked from public release. 


Bash, who was Panetta's chief of staff while Panetta was CIA director, sent the email to four people 
— including George Little, a Pentagon spokesman who was a former CIA spokesman, and Philippe 
Reines, an aide to Secretary of State Clinton. 


Bash ends the email by instructing Little, the former CIA spokesman, to "please lash up with (blank)" 
— presumably either the spy agency or one of its employees. 


Reines forwarded the email to Clinton State Dept. aides Cheryl Mills and Jake Sullivan, who 
forwarded it to Clinton. There is no record of Clinton commenting. 


e@ "IF SOMEONE ON MY 
STAFF DID WHAT SHE 
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Bash, in an interview, said the email wasnot . DID... THEY WOULD BE 
lassified when it was sent or forwarded, and, FIRED AND THEY WOULD 
"did not reference the individual's name, ' BE PROSECUTED" 


employer, nor any identifying description or 
information." 


Once the CIA posthumously lifted Lorenzetti’s cover, Bash added, "the original unclassified email 
could be read to confirm the general use of cover, prompting the redactions we now see. But any 
suggestion that this email contained confirmation about the person or his cover, or any inappropriate 
information, is flat wrong." 


The 2012 email wasn't the only one referencing a CIA officer or program, officials said. The 
references were indirect, and Clinton made no comment about them, the officials said. 


Some of the references to covert intelligence officers, and other discussions of CIA drone strikes, 
were against classification rules and were "sloppy," one official said. But views are split on whether 
they were damaging to national security. 


It's unclear, the officials said, whether the emails would have provided significant insights to foreign 
intelligence agencies, if, as many experts say is possible, Clinton's private server was penetrated or 
hacked. 


he messages at issue are part of a longstanding pattern of senior officials at the State Department 
and other government agencies trying to talk around classified information over email, sometimes 
unsuccessfully. 


What makes Clinton's case different is her use of a home server to transmit emails about 
government business. The issue has continued to be a factor in her front-running campaign for the 
Democratic presidential nomination. However, given that the State Department's email system has 
been penetrated by hackers linked to Russian intelligence, it's far from clear whether the material 
would have been any more secure had Clinton used State's unclassified email system. 


Clinton and her senior aides had access to secure messaging and telephone systems, but they were 
not as convenient as email. 


As the Associated Press has reported, State Department emails previously made public show a 
history of classified information slipping into unclassified email. Examples have been posted on the 
State Department's website in response to Freedom of Information Act requests. Although the 
classified information has been redacted, it is possible to glean insights into the sensitivity from the 
context. 
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In emails about the 2012 attack on a U.S. diplomatic facility in Benghazi, Libya, department officials 
eo: state.gov accounts discussed the movement of Libyan militias and the locations of key 
‘Americans. 


An email from diplomat Alyce Abdalla, sent the night of the attack, appears to report that the CIA 
annex in Benghazi was under fire. The email has been largely whited out, with the government citing 
the legal exemption for classified intelligence information. The existence of that facility is now known; 
it was a closely-held secret at the time. 


In five emails from state.gov email accounts that date to Condoleezza Rice's tenure as secretary of 
state during the Bush administration and have been publicly released after FOIA requests, large 
chunks are censored on the grounds that they contain classified national security or foreign 
government information. 


They include a December 2006 email in which diplomat John J. Hillmeyer appears to have pasted 
the text of a confidential cable from Beijing about China's dealings with Iran and other sensitive 
matters. 


Large portions of the email were marked classified and censored before release. 


Clinton insists she didn't send or receive information marked classified. But she signed a non- 
isclosure agreement acknowledging that information can be classified regardless of whether it is 
"marked or unmarked." 
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C058438283IFIED U.S. Department of State Case No. F-2015-05052 Doc No. C05843828 Date: 01/20/2016 
Obtained by Judicial Watch, inc. via FOIA 


Kennedy, Patrick F : 


From: Lukens, Lewis A 

Sent: Saturday, January 24, 2009 8:26 PM ae. ee 
To: Kennedy, Patrick F |RELEASE IN PART Bé| 
Subject: Re: Series of questions cme - = 


| talked to chery! about this, She says problem Is hrc does not know how to use a computer to do email - only bb. But! 
said would not take much training to get her up to speed. 


From: Kennedy, Patrick F oe 2 = 

To: Lukens, Lewis A; ‘habedit j ‘emit 

Ce: Smith, Daniel B =e 

Sent: Sat Jan 24 20:22:20 2009 
Subject: Re: Series of questions 


[REVIEW AUTHORITY: Frank Tumminia, Senior Reviewer 
That Is why this is the best solution 


From: Lukens, Lewis A 

To: ‘habedi ; Kennedy, Patrick F; ‘cmitid 
Ce: Smith, Daniel BS 

Sent: Sat Jan 24 19:49:30 2009 

Subject: Re: Series of questions 


She'll be able to. 


From: Huma Abedin 
To: Kennedy, Patrick F; Lukens, Lewls A; Cheryl Mills 
Ce: Huma Abedin ; Smith, Daniel 8 

Sent: Sat Jan 24 19:48:27 2009 

Subject: Re: Series of questions 


Yes we were hoping for that if possible so she can check her email In her office. 


+----Original Message----- 


From: Kennedy, Patrick F <KennedyPF@stute.vov> 
To: Lukens, Lewis A <LukensLA@state.gov>; Cheryl Mills 


CC: Huma Abedin; Smith, Daniel B <SmithD2@stute.zov> 
Sent: Sat Jan 24 19:29:25 2009 

Subject: Re: Series of questions 

Cheryl 


The stand-alone seperate nctwork PC is on on great idea 


UNCLASSIFIED U.S. Department of State Case No. F-2015-05052 Doc No. C05843828 Date: 01/20/2016 
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Obtained by Judicial Watch, Inc. via FOIA 


Ce: ‘habedit Kennedy, Patrick F; Smith, Daniel B 7 B6 
Sent: Sat Jan 24 19:10:33 2009 
Subject: Re: Scries of questions 


We have already started checking into the NSA bb. Will set up the office across the hall as requested. Also think we should go ahead 
(but will await your green light) and sct up a stand alone PC in the Secretary's office, connected to the internet (but not through our 
system) to enable her to check her emails from her desk. Lew 


From: Cheryl Mills 

To: Lukens, Lewis A 

Cc: Huma Abcdin ; Kennedy, Patrick F 
Sent: Sat Jan 24 19:05:24 2009 
Subject: RE: Series of questions 


So | have now read up more on POTUS’ bb (which appears not really to be a bb but a different device). 


is there any solution to her being able to use an encrypted bb like the nsa approved one he has in the vault and if so, how can we get 
her one. 


and if not, Ict’s set up the office across the hall for her to use — it needs a phone ctc. so she can go across the hall to check her bb. 


From: Lukens, Lewis A [mailto;LukensLA@state.zov) 
Sent: Friday, January 23, 2009 6:54 AM 
: Cheryl Mills 


Subject: Re: Series of questions 1 


Questions 1 and 2 - yes. Will give you more details this morning 


On the bb for hrc, can we chat this moming? 1 may have thought of a workaround but need more info on her bb use from you. 


Lew 


Cheryl Mills 

ukens, Lewls A 

Sont: Fri Jan 23 06:47:59 2009 
Subject: Series of questions 


Lew- 


UNCLASSIFIED U.S. Department of State Case No. F-2015-05052 Doc No. C05843828 Date: 01/20/2016 


HRC-1428 


C05843828iFIED U.S. Department of State Case No. F-2015-05052 Doc No. C05843828 Date: 01/20/2016 
Obtained by Judicial Watch, inc. via FOIA 


who can I talk to about: 


1. can our email be accessed remotely through the web using a non-DOS computer like my laptop? 

2. 1am traveling to the M-E tonight — will my DOS bb work thero and is there a cell phone attached? 

3. spoke to Dan re: bb for HRC (and reporis that POTUS Is able to use a super encrypted one which) 

4, spoke to Dan re: setting up Counselor office for HRC so she can go across hall regularly and check her email. 
cdm 
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C05840675 US. Department of State Case No. F-2015-05043 Doc No. C05840675 Date: 11/05/2015 


RELEASE IN PART 
B1,1.4(G),1.4(E),B7(C),B6,1.4(C)) Vv 


DECL: 03/02/2019 4 AUTHORITY: 
1.4(§ Barbara Nielsen, 

INFORMATION MEMO FOR CHERYL D. MILLS ~S 1.4(Gsenior Reviewer 
B1 


FROM:  DS-Eric J. Boswell 
SUBJECT: Use of Blackberries in Mahogany Row 


. . We have worked closely! to review all options that would allow 
" Secretary Clinton, you, and a small number of staff to use Blackberries 


na ad review reaffirms our belief that the vulnerabilities and risks associat 

With the use of Blackberries in the Mahogany Row|__|considerably outweigh 1.4(E) 
the convenience their use can add to staff that have access to the unclassified Lae) 
OpenNet system on their desktops. | 

We also worry about 
“the example that using Blackberries in Mahogany Row might set as we strive to 
promote crucial security practices and enforce important security standards among 
State Department staff. 


As an alternative, we suggest that DS work with S/ES-IRM to make access 
to the Secretary’s OpenNet account on her desktop workstation as easy and 
convenient as possible. For example, we are happy to work with IRM to lengthen 
or even eliminate the time-out function to allow the Secretary’s Special Assistant 
to log-on to review her emails and schedules. . 


While we cannot recommend using Blackberries inside the Mahogany Row, | AE) 
we do not want to stand in the way of issuing Department Blackberries to 1 4(G) 
e Secretary and her senior staff for use outside Mahogany Row. Those B1 
Blackberries can be synchronized with. your OpenNet Microsoft Outlook accounts, 
provide full cellular, e-mail, and internet functionality, and provide unclassified 
mobile technology when you are away from Mahogany Row. 


I cannot stress too strongly, however, that any unclassified Blackberry is 
highly vulnerable in any setting to remotely and covertly monitoring conversations, 
retrievirig e-mails, and exploiting calendars. I am attaching reports from DS’s 


a Reacane 1 4 fe . 
UNCLASSIFIED U.S. Department of State Case No. F-2015-05043 Doc No. C05840675 Date: 11/05/2015 


HRC-1430 


Yd 


y 
C05840675FIED U.S. Department of State Case No. F-2015-05043 Doc No. C05840675 Date: 11/05/2015 


age 
Office of Computer Security’s Cyber Threat & Analysis Division that give further 


background on those risks. j 
1.4(E) 
1.4(G) ° 
B1 
If, after considering the vulnerabilities that I describe above and the 
alternatives that I propose, the Secretary determines that she wants alimited =» 
number of staff to use Blackberries in the Mahogany Row| 
1.4(E) 
1.4(G) ° 
B1 
. 1 
irpts from DS/CS/CTAD Reports on Blackberry Vulnerabilities ¢} 
1.4( 
Tab 3 — New York Times Article: “Obama’s Phone Security and Yours” set i 
Tab 4 — Washington Post Article: “Your Cell and Your Berry: Tools for the BI 
Enemy” 3 


1043 Doc No. c0s840675 Date: 11/05/2015 
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Eric J. Boswell 

Assistant Secretary for Diplomatic Security (1996 to 1998, and 6/2008 to 12/2012) - 
Director of the Office of Foreign Missions (DS/OFM) (6/30/2008) — 

Assistant Deputy Director for Security ODNI (2005 to 2008) 


e Introduction 
o Voluntary / Can stop at any time JS 
© NSLB Disclaimer re: Garrity / not interested in prior statements to DOS 
© FBI’s interest in this matter is to assess whether classified information was stored or 
transmitted on the server and if it was compromised by either authorized or 
unauthorized users. 
© Discussion of classified topic, if necessary 
¢ Brief overview of duties 
© What is your current position? 
o What were your duties at DoS? 
© What were your duties as the A/S of DS, as relevant to the security of the Secretary's 
communications? 
* Knowledge of the private server, email system, and other devices? 
© Did DS have any role in the set up, or maintenance of the server? 
= Ifso: 
¢ What was there an approval process for the use of private email / email 
servers? 
* What steps were taken to review the risks / benefits of this 
arrangement? 
¢ Who was involved in the review process? 
* Was this consistent with DoS policy at that time? 
¢ Did the server violate department policy as stipulated in the Foreign 
Affairs Manual? 
* What is the current policy today? 
o When / why did it change? 
What role did DS play with respect to providing secure communications to Secretary? 
Did DS provide any guidance / recommendations on the use of devices? 
© What secure comms were available to the secretary at her home and when she was 
traveling? 
= Phone, Fax, Email (Classnet / JWICS) 
¢ Discussion of Memo 
© What was the context of this memo? 
© Who requested to use BB on Mahogany Row? 
= Had this been done by previous secretaries? 
= Why did she need her BB on Mahogany Row? 
= Do you (or DS) know of requests made by Cheryl Mills for a standalone system 
that wasn’t on the DoS network? 


HRC-1432 


* It appears that the issue is connecting to private server / email from DoS. How 
was this resolved? — i.e, BB on Mahogany Row, separate computer system, 
other? 

© Can you please explain the last paragraph? 

* If after considering the vulnerability that | describe above and the alternatives 
that | propose, the Secretary determines that she wants a limited number of 
Staff to use BB in Mahogany Row [redacted] ) 

= What was the Secretary’s decision? Ds teste Ce = 


< tnes to ID 
© References to Office of Computer Security Cyber Threat & Analysis Division Tne t ty ed. 
v = What were the primary threats facing DoS at that time? classy 
‘“ gb = How was threat information relayed to the Secretary ib ner geam? Mema [ wD. 
rae ow ¢ = Are there any specific threats that you recall? / lndi duo or Mase M 
soa & = Were there any other issues or concerns regarding general security posture of 
& the Secretary and her team? (i.e., Egregious actions, not minor infractions) 
ae * Who was the primary POC in the Office of Computer Security Cyber Threat and 
Analysis Division at that time? 
* How does Office of Computer Security fit in to world of IRM, IRM-S/ES, PACE, 
etc? 
¢ Is there anybody else that we should talk to regarding this matter? 
¢ Any other thoughts / concerns regarding this matter. 4 
ib ty deicy—- 
e NDA request 
breathes . 
4 pur nes 
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From: Lee, Purcell N 


Sent: Tuesday, March 17, 2009 1:35 PM 

To: Wagganer, Kevin L; Bentel, John A; Scott, Andrew C 
Cc: Duncan, Bruce E 

Subject: Secretary Residential Installation Hotwash 
Attachments: Secretary Residential Installation Hotwash.docx 


Attached is the agenda/talking points for the hot wash. 
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Secretary Residential Installation Hotwash 


1. Equipment location: 


b. 


c. 


Unclassified Partner System: 
i. Server: Basement Telephone Closet 
ii. Telephone Set: Various rooms 


Classified Fax: 
i. STE/Secure Fax: Third Floor 


Classified Red Switch: Third Floor 


2. Status of Installation: 


. Unclassified Partner Telephone System: Completed. 

. Classified STE/Fax: Completed 

. Classified Red Switch: Completed 

. Unclassified Ops Drop: Verizon is still working to finalize path. 
. CMS Classified Video: Declined 


CMS Classified Voice: Declined 


3. Issues: 


T1 Telephone Services were not available upon arrival 


. Analog lines (2) for the Partner system was not ordered. 


Red Switch Technicians arrived 2 days later than scheduled. 
SDS Data Cable was left in Washington 

Former President’s wireless headset was disconnected 
Secretary Clinton’s headset noise cancelling was not selected 


. Speed Dial for Secretary Clinton Unclassified telephone was not 


working properly. 


. Secretary’s Clinton’s business lines were not set up in a “Hunt Group” 
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—————————————— 


From: "Hanley, Monica R" <SBUSTATE/SES/RECIPIENTS/HANLEYMR> 
Sent: 8/30/2011 5:32:36 PM +00:00 

To: ‘huma@clintonemail.com’; "Abedin, Huma" <AbedinH@state.gov> 
Subject: HRC blackberry 


John bental (202-647-4656) just called me abt getting hrc a new blackberry for the paris trip. He said that he heard that 
the chapp server is down. He said that the she spoke to the comm guy directly abt it this morning 


It looks like she's receiving email on her ipad. Does she want a state berry for the trip? They wid like to know this 
afternoon so that they can set up. 


I told him that | wasn't sure and that | wid ask you. 


pn 
AGE_ID: -State-Sbu> 


PR_RIM_PAGER_TX_FLAG: true 


PR_RIM_MSG_STATUS: 1 b6 Per 
PR_RIM_MSG_ON_DEVICE true b7E DOS 
_3_6: 

PR_RIM_MSG_REF_ID: -1561860114 


PR_RIM_MSG_FOLDER_ID: -6 


PR_RIM_MESSAGE_SUBMI 
SSION_ID: 
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From: “Hanley, Monica R" <SBUSTATE/SES/RECIPIENTS/HANLEYMR> 


Sent: 8/30/2011 10:09:28 PM +00:00 
To: "Abedin, Huma” <AbedinH@state.gov> 
Subject: Re: S berry 


Do you want a different address? 


_— Original Message ----- 

From: Abedin, Huma 

Sent: Tuesday, August 30, 2011 05:19 PM 
To: Hanley, Monica R 

Subject: Re: S berry 


That can't be it 


— Original Message ----- 

From: Hanley, Monica R 

Sent: Tuesday, August 30, 2011 04:19 PM 
To: Abedin, Huma 

Subject: Fw: S berry 


SSHRC @state.gov 


— Original Message ----- 

From: Bentel, John A 

Sent: Tuesday, August 30, 2011 04:15 PM 
To: Hanley, Monica R 

Subject: RE: S berry 


Monica: We actually have an account previously set up: SSHRC@state.gov. There are some old emails but none 
since Jan '11 -- we could get rid of them. 
You should be aware that any email would go through the Department's infrastructure and subject to FOIA searches. 


Let me know if any questions and what you would like us to do. 


Thanks! 
John 


SBU 
This email is UNCLASSIFIED 


From: Hanley, Monica R 

Sent: Tuesday, August 30, 2011 3:59 PM 
To: Bentel, John A 

Subject: S berry 


Do you know what her email address would be on astate dept berry? 


b6 Per 
PRRIMINTERNET MESS [0 

AGE_ID: State.sbu> b7E DOS 
PR_RIM_PAGER_TX_FLAG: true 

PR_RIM_MSG_STATUS: 1 
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PR_RIM_MSG_ON_DEVICE true 

_3_6: 

PR_RIM_MSG_REF_ID: -1805720130 
PR_RIM_MSG_FOLDER_ID: -6 


b6 Per 
PR_RIM_MESSAGE_SUBMI b7E DOS 
SSION_ID: 
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Field Office Acquiring Evidence Wie 


Serial # of Originating Document A 


Date Received (alej2ar &b 


From 


{Name of Coninibutor/inicrviewee) 


(Address) 


(City and Suite) 


To Be Returned 


ReceiptGiven (© Yes 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


O Yes No 
Federal Taxpayer Information (FTI) 


O Yes Arvo 
MEDEA BUM 
PUSUANDLENG- FUMBEF LIED 


Reference: 


(Communication Enclosing Material) 
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3 June Meeting — Proposed Agenda 


i 
Here is a proposed agenda, but | defer to the host to change or delete any portion that it feels is 


unnecessary or inappropriate 


Introduction and Background 


ee a oe al a 


Background of the Principals. 


Caveats —Not a USG Project; no systems, sources, methods, means, personnel, data, or 
any other resources of the USG were employed, only commercial off the shelf resources, 
both known and unknown to the principals. 

Background of Project as authorized by customer JW. 

The Phase | Scope and Order of Magnitude 


Results of Phase | - Was SB server or computer entered and if so, did the data 
move offshore? 


SB Server was entered directly and data was moved to Guccifer server or computer. 
SB server contents was then moved from Guccifer server to a second IP nearby. 

Not clear who this second server is owned by, but data was definitely moved. 

Data includes memos from SB to HRC and found on SB server. 
The secondary source has over 37,000 files on it, and many (over 200) trace to SB. Of 
these, 25 or so were traced and recovered, all of which show positive indications as 
having been authored by SB, sent to HRC, and recovered. 
The discussion within these memos suggest SITREPs and alleged Intel Assessments using 
HUMINT on the ground in Libya. 

| 


Results of Phase Il - Was HRC attacked directly or indirectly? 


Of the 37,000 files, we would need to open each and trace back the content to the 
original server. The Phase | assignment did not include a scope of this magnitude. 
However, Key word searching of the spreadsheet show many references to HRC and 
other symbols that may be files that came directly from the HRC server. It is unknown 
at this time whether there was a direct, pernicious attack and wholesale exfiltration, 
based upon the evidence assembled to date. 

One file was recovered but the providence is not clear. This file has attributes that are 
similar to other.Libyan-based SITREPS, that were found. The time, topic, context, 
names, and background all seem to align with these suspected attacks. However, much 
additional research is needed to trace this document to its original source. 

The document did not come from SB or was not found among files that came from his 
SPAR: It did bare, according to one source, signatures of the IP for the HRC server 


HRC-1817 


b6 
b7c 


and is suspected to have come from her computer or at least a computer linked to an IP 
address that ties to where the server was in 2009. 
5. Ifthis document is deemed to be genuine, authentic and relevant to the issues here, it 
tepresents a major loss of grave concerns. 
tM. Results of Phase | - What was the possible motive of SB? Was it to create a quid 
i 
pro qua? 


1, ‘Rogue National Judgment Recovery Work. 
2. Work with the Libyan Opposition Government 
3. ‘Work with the new foreign minister as a back channel 


W. | Way Forward 


1. Anumber of possible ways to obtain more specific evidence as to SB motive and to 
check the veracity of the Rogue National Recovery Program connection to SB and 
others. 

Recover all 37,000 files under the International Bulk Data Silo Procurement Program. 
Could be done by the host, or could be contracted or could be part of Phase Il. 

Many different options on where, how and when to collect the data and subject to 
analysis. 

Check the providence of the key document and try to trace it back to the original 

| source. 
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Questions or Comments 
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Travel, 


More ? 
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Learn more 


Revert to the old chat 
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https://mail.google.com/mail/u/0/#sent/1550dc077708277 1 
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Move to Inbox 
Phone call Inbox x 


_— send as we discussed. Thank you and look forward to meeting yo 
ae download the file via the link sent in a separate email... 


| 


Thanks - | was able to download all the files. On Thu, Jun 2, 2016 at 10:17 A... 


L_] 


A somewhat urgent update: 


For the past six weeks when the hypothesis of the SB portion of the report was 
over the dates of the seminal events, the key name of the person, and the con’ 
with any evidence tending to support the timeline. 


| finally recalled the way to track this down much to my relief because for a whi 
recollections on this issue and confusing facts. Indeed, | was not. Below are s 
rt a etermine whether the hypothesis has any merit at all. 


Friday, January 20, 2012 1145 Al 
Friday, January 20, 2012 1150 AM| 
Monday, January 16, 2012 1015 Al 
Monday, January 16, 2012 1015 AM ver 
Saturday, January 07, 2012 1103 AM From| 
Thursday, January 26, 2012 1111 Al 


MAIL TO 


EMAL TO] | 


r the weet 


| will highlight the relevant section in Yellow so that it fits the story line and con! 
Let me know if this is something you wish, or if you just want an oral brief as a 


should be done at some point, only because it is really important data and has 
have been mystified about since | was engaged on this matter. 


Take me to Inbox 
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ECUTIVE SUMMARY OF RESEARCH FINDINGS 


In addition to the above, the Phase I Study resulted in some other detailed findings that are best 
summarized below: 
| 
1. The computer of Sidney Blumenthal was positively identified as hosting 
many emails and attachments originating from Hillary Clinton’s server and 
others from the Clinton Foundation. In Phase I, we recovered at least 20 
memos from Mr. Blumenthal to Mrs. Clinton that contained Situation 
Reports (SITREPS) allegedly based upon intelligence sources in Libya. 


Mr. Blumenthal’s server was successfully attacked by Marcel Lazar Lehel, 
originally from Bucharest, who is also known as Guccifer or “Small Fume”. 

| 

While one spreadsheet shows that over 37,000 files were found on a closed 
encrypted and password protected site of someone other than Guccifer, only 
a full analysis of the spreadsheet will reveal all of the files traced back to 
Mrs. Clinton’s server directly, or to that of Mr. Blumenthal. These files were 
traced to a computer that was using an application to access the Peer-to-Peer 
networks. The computer was traced to IP address 84.232.210.154, which 
points to Bucharest, Romania. 


. One search revealed that data that originated from Mr. Blumenthal’s server 
was transferred to the computer at 84.232.210.154 on July 5 2014 at 07:12 
(Bucharest Time), and yielded many references to “HRC” within the 
spreadsheet. This would suggest that the content of the computer traced to IP 
84.232.210.154, was not Guccifer, but someone else who accessed his server. 
The reason is that this “migration” occurred long after Guccifer was 
identified, arrested, and incarcerated in Romania. Several possible 
explanations exist: 


' {8} Guccifer had a co-conspirator that continued to operate the 
! collection from various sources as a “get out of jail free card”; 


{b) The computer doing this collecting did belong to Guccifer, and he 
allowed it to run long after he was arrested. This scenario seems 
unlikely for a number of technical reasons. 


{¢} This computer belongs to a foreign service or someone else who 
attacked the Guccifer server and transferred the data to computer 
84.232.210.154. 
Notwithstanding the above, data from both the Blumenthal computer and 
the Clinton email server migrated to Guccifer, and then to a computer tied to 
IP 84.232.210.154, both of which were located outside of the United States 
and outside of the control of the US Intelligence Community. Assuming 
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either contained overtly classified data or retrospectively classified data, this 
is considered a major Counterintelligence concern and of interest to the 
Community. 


Guccifer entered the Blumenthal computer several times, first through 
Blumenthal’s AOL account. It is not clear whether Guccifer targeted 
Blumenthal because he represented an opportunity of interest, or because a 
foreign service directed him to the account. Also, it is not clear whether the 
account was entered after he first entered the Clinton server or that of 
someone else on the Clinton domain server. 

. During Phase II, much additional information can be obtained on the 
sequence, timing and chronology of when the two servers in question were 
accessed and in what order and how many times. 

We found indications that Guccifer or person or persons acting on his behalf 
or persons impersonating Guccifer did a secondary penetration of Mrs. 
Clinton’s server on May 22, 2009, and other penetrations thereafter. 


. We confirmed that Guccifer used an anonymous server located in Russia to 
conduct the penetration, and therefore, there is a high possibility that the 
Russian services that monitor these anonymous servers likewise have a copy. 

. One file that was found on Mrs. Clinton’s server was not found on the 
Blumenthal server. This file represents a major loss to the Intelligence 
Community because it appears to be targeting data. The data is first in 
Russian and then converted to Arabic. It represents a list of targets that quite 
possibly was created by a Russian source, located or intercepted by our 
services, and transmitted to Mrs. Clinton by some unknown person. The file 
then left her server and was found in the Deep Web and Dark Web. 


The above cited file, an excel spreadsheet, we assess, would enjoy the highest 
level of classification if submitted to a person who has original classification 
authority. The file was found stripped of its collars (if they ever existed). If it 
is determined by the FBI that this file ever was overtly classified, it will serve 
as a potential “smoking gun document.” 


Guccifer penetrated a number of targets and we recovered over 37,000 files 
from a computer traced to IP 84.232.210.154 that he obtained. We created a 
mapping of those files as they appear in the Deep Web. We then tested the 
spreadsheet and the content behind the spreadsheet (the 37,000 files) using 
key word fuzzy logic. We confirmed the following Blumenthal memos were 
found on the Clinton Server and vice versa: 
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13. A complete copy of the Blumenthal memos sent to Mrs. Clinton were opened 
recovered in original format and deserves critical analysis by counsel. Most 
all were word documents and related to a number of issues. These can be 
provided to counsel as a means to substantiate the claims of Guccifer. 

. We did not actually collect the content of Mrs. Clinton’s server or the content 

of computer 84.232.210.154 at Phase I; we merely validated the major 
premise and hypothesis that data originating from either or both of the 
Clinton and Blumenthal servers were attacked, directly or indirectly, and 
then were moved outside of the US to Guccifer; and then migrated to 
computer IP 84.232.210.154, owned and operated by unknown persons. 
Additional research is required to cull through the 37,000 files found to select 
those that pertain to Mrs. Clinton and which came directly from her server. 


We note that there are profound legal questions regarding Phase II because 
it is not clear what our obligations may be regarding recovery of potentially 
classified data that may or may not contain actual collars that overtly show 
the content was classified at the time they were sent to Mrs. Clinton; or 
emails and attachments that were retrospectively classified but were released 
in truncated form. Our recovery of such content would be untruncated and 
in original condition. 

It is conceivable that one possible motive for Mr. Blumenthal’s decision to 
feed Mrs. Clinton the SITREP reports was to promote his group as a quality 
private intelligence group in Libya capable of obtaining detailed intelligence 
from various unnamed, disparate sources as to the thinking, actions, 
planning and intentions of key operators in the region. We do not opine on 
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the accuracy of the intelligence provided, only the tone and intent of the 
memos. Our assessment is that they are essentially, crafted as “shake and 
bake” intelligence assessments, done to promote a need by the Blumenthal 
group, and not to turnover information because of some legal or moral 
obligation. 


17. There is objective evidence to indicate that_a person identified as rad 
Ce Ticlephone 


(circa. 10 January 2012) began to solicit Senior Intelligence Analysts with 
experience in repatriation of assets plundered by the Qaddafi family. This 
person began the solicitation process on approximately January 25" 2012, 
claiming that he led was dealing with representatives of a “high level political 
types in the US within the State Department” and that he personally had 
high level contacts within the new Libyan Opposition Government that he 
would have a contract with to begin the repatriation process. 


| has a rather controversial history within the US b6 
i i icularly , His links to bic. 
was one of the prime operatives in Libya. 


Notwithstanding his reputation in the US Intelligence Community, he was 
believed to have highly placed contacts within Libya which could have been 
mined for creation of a Rogue Nation Asset Recovery program, but for his 
limited technical and intelligence analyst resources. 


Phase II 


The proposed Phase II study includes: 
t 
1. Recovery and sorting of all Guccifer data on the server in Romania, to obtain 
all data that came from Mrs. Clinton’s server as well as Mr. Blumenthal’s 
server. 


Analyze all of the content of the computer IP 84.232.210.154, which appears 
to be different from the Guccifer server, although both apparently are 
located in the Bucharest, Romania area. 


3. Guccifer claims in recent reports that the secret server contains about 2 
Terabytes of data and represents all of his hacking efforts. We opine this 
Statement is most likely accurate. The spreadsheet that we obtained which 
maps the secret server substantiates this claim, assuming a portion of it 
originated from the Guccifer server. 


4. The Clinton smoking gun data document needs to be mapped back to her 
server to make the clear connection which has not been satisfactorily 
established. 
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5. The IP address and email addresses of Mrs. Clinton and her colleagues who 
used this server need to be checked to determine whether any content traced 
back to the server or the email address can be recovered from the Deep Web 
and the Dark Web sources to which we have access. 


The recovered data content needs to be date stamped and placed in a 
chronological arc to triangulate against the activities of Mrs. Clinton, 
particularly around the time when she was dealing with the Benghazi 
investigation. 

Counsel needs to determine from quality counsel with National Security 
experience and intelligence experts, the legal obligations by cleared persons 
to report and surrender data that may have overtly labeled classified data; or 
data that would objectively be considered classified had it been 
hypothetically subjected to a person possessing original classification 
authority. 
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Introduction and Overview 


In an effort to determine whether there was evidence to indicate if a search‘e 3 
spheres using mid-level recovery tools was fruitful, the customer requested that we begin our 
research on a limited basis, and provide results for Phase I only. The critical search terms are the 
email sérver MX codes, the headers or footers of the email server, or at a minimum, the domain 
server name which is fairly unique. 


i] 
The customer has agreed that the only exception to # 
reserved only to the client and its law firm) is 
suggesting (directly, indirectly, overtlyvor, otherwig)'¢ f 
we do not possess original classification authoriyy) kad been absconded from the United States 
(wherever situated) and placed-on an outside ser or device aug discovered by us. 


e advised the client that we have 
Aifotmation.as well.as the context of that information to the 
or out Af, the Intelligence Community. (e.g., Federal Law 
inal’ Divi (on, a$,opposed to the National Security Division) of the 
Xl to this single condition or exception to the privilege. 


Should this have occurred, or is suspge 
legal obligations to tum over thatf 
appropriate authorities, ins; 
Enforcement within, the © 
FBI. The client hi 


During this pliase, we were fiot.engaged to determine who accessed the server or where its 
contents ultimately, landed gf came to final rest. However, we were able to determine that: 


(a) Sidney Blumeni hal’s server was directly hacked by Guccifer and Hillary Clinton’s server 
rectly atyacked by Guccifer, probably as a result of first hitting Mr. Blumenthal’s 


i ne 

(b) The Blumenthal content was transferred to a computer or server located south of 
Bucharest, Romania by Guccifer; but we also found this content outside of his server or 
computer where it still remains to this day and is under another IP address. 


(c) We confirmed that it was possible the same person or persons acting on Guccifer’s behalf 
or persons impersonating Guccifer did a secondary penctration of Mrs. Clinton’s server on 
May 22, 2009. 


(d) While the first “pop” where the Clinton/Blumenthal content landed could have been at 
the Guccifer server, the place where we recovered the files containing this content was not 
the same server as where Guccifer hid the files, based upon our limited scans to date. The 
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reason is that this server IP address is continuing to collect to this day, and moreover, the 
date when the content was first seen after when Guccifer was apprehended and jailed in 


Romania. More clarification of this point is needed at Phase II as to who truly are the 
‘creator and owner of the server where we found this content and report it here. 
i 


{ 
‘(e) We believe that the IP address where we found the files is 84.232.210.154, which is not a 
server, but is actually a computer using an application that accesses files on Peer-to-Peer 
‘localities. In essence, the computer is utilizing the Direct Connect P2P application which 
disclosed the content of the computer to others on an open network known as the Deep Web 
cor Dark Web. Upon checking IP address 84.232.210.154, we recovered in excess of 37,000 
files, of which at least 200 appear to have come from Mr. Blumenthal’s computer. Of the 
200+, we verified the authenticity of a representative sample of over 20 having been 


a computer means it 
is “open source” and therefore publicly available. In esse e found it, others have 
found it — nothing that we are doing in our trawling repre cret saice” OF squrce. © 
Our tools used may be different or better from a foré ese 
resources are generally available. 


(g) There is subjective evidence suggesting that:Mi 
had a motive to present to Mrs. Clinton 
possible quid-pro-quo of sorts, but 
deal may have included participation in the rogue n: 
the Libyan Opposition Government, in exchange fo 


to solicit Senior Intelligence Analyst: Gain in repatriation of assets plundered by 
the Qaddafi family.2 This person;btg fhe solicitation process on approximately January 
25" 2012, claiming that_h dling. with representatives of a “high level political 

S id that he personally had high level contacts 


a rather controversial history within the US 
Ce | His links a 
yy: lotwithstanding is reputation 
ia which could have-beeg ‘mined.for reation of a Rogue Nation Asset Recovery program, 
‘but for-his limited fechnicaf and intelligence analyst resources. 


‘ 2 @ After the above sc! pie floundered, others representing the Libyan Opposition Coalition 
Government: sought Ao re-start the contract that we believe Mr. Blumenthal and his 
€olleagues had. This/re-ignited effort occurred as recently as December 2015. 


Searching the Deep Web and the Dark Web is not the same as conventional searching using a 
normal web browser. One not only must have a different tool, but also have the tool with the 
correct protocol to access a specific site. Often, to gain access to an IP address containing 
hidden files, such as what we see here, the protocol tool is uniquely different and it often takes 
considerable effort to find the correct, corresponding protocol tool so that one has complete and 
unfettered access. 
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Employment of these protocols is done by the owner of the site where the files are located in 
order to maintain the integrity and security of the site where the hidden files are located and to 
keep “prying eyes” out. 


Once the location of the files is identified, the next step in the process is gaining access to the 
site, obtaining, collecting and acquiring all of the files, and downloading them to a safe and 
secure environment. 


In this case, the computer of Sidney Blumenthal was positively identified as the host of many 
documents sent to the server of Hillary Clinton and others from the Clinton Foundation. Mr. 
Blumenthal’s server was successfully attacked by Marcel Lazar Lehel, als¥ known as Guccifer or 
“Small Fume,” originally from Bucharest. While one spreadsheet shows that:over 37,000 files 
were found, only a full analysis of the spreadsheet will reveal all of thé:files traced back to Mrs. 
Clinton's server directly, or to that of Mr. Blumenthal.! 


maintained in secret, or allowed to continue to run and€olle 
he was, incarcerated. However, this assessment seetns bofh’ d no aitularly 
logical. |More likely, the content we discovered.at the IP/address»cited ‘tg, an unknown 
person that originally collected some of the BluttenthAl/Cli onterft from the Guccifer 


server, and then moved it to where we located'it. If: th 


We assess that it is possible Guceifer ente 
through! Blumenthal’s AOL aceoun 
because he iy aay: an: Opportuhity inyérest, Or _ because a foreign service directed him to 


additional information obtairied gn the seqiience, timing and chronology of when the two 
servers in question wer 


of / OF retaliation — rather he does it for money and to sell data to 
e was indicted and jailed in Romania and at the behest of the US 
xtradited to the United States where he was also charged and 


Clinton‘email scandal:e 
at the timé.when the 
Justice Department. 

| 
Guccifer hopscotcked among the accounts of victims such 


(ted into the public domain, it is curious that his transfer comes exactly 
Most needs him, when they are finalizing their prosecutive memo to the 


* For additional information on files extracted from the server of Sidney Blumenthal by “Guccifer only”, and found on a Password Protected, 
encrypted server of “Guccifer” in Bucharest, Romania, please see Attachment #3 Blumenthal Server Traced to Bucharest First Attack 
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Along the way, Guccifer gathered the cell phone numbers o pes 
the private e-mail addresses fo: 


By breaching Blumenthal’s account, Guccifer was able to access files that go back to at least 
2005 involving an array of Washington insiders, including political operatives, journalists, and 
government officials. Based on screen grabs made by Guccifer, he specifically zeroed in on 
Blumenthal’s emails to and from Hillary Clinton, sorting Blumenthal’s account so as to single 
out all e-mail sent to Clinton. 
i 

Additionally, Guccifer further sorted the mail so that he could download 
to e-mails sent to Clinton, as well as the emails, .pdf documents as well ag 
created a spreadsheet of the entire drive of where the Blumenthal as yell ‘as.the Clinton files 
landed, a private server in Bucharest, and identified nearly 37,000 recojds, not all ‘of which came 
from me Blumenthal/Clinton Server, but represent the fruits of the Gufci ifoP s.labors over time. 


1 Word files attached 
star and .zip files. We 


An Sue of the spreadsheet.di 
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Examples of just a few of the indexed entries from the spreadsheet that represent emails that 


were the consequence of a “direct attack” upon Mrs. Clinton and were sent to Mr. Blumenthal 
are found below: 


wr vobtssndsars 1098attre ree6$): 2/9/4038 732 
ASUS OCIRES Ms 3Aeee 779/206 


Secsosh 320 766bsd wi ROO? NENT) YIS/I018 1 


ere says 
“mse. mnenn?s mere DISA sce 
we snores_private_ corres tions, 691212 dora Tdney Dlumartbel 
astober 


‘9460385 9000%D1764se3 Phe tb37 ZENE. 773/2006 
parpilee SARI hot dey urnonthat 


‘sabes cahainc 2 SRGAMOHSRIKD AML IPSS 2024 
eAdsIUSAETAGT CHO AGEIONBIEACOY:T/8/1018 F:22 


It is not|clear whether the cited memos were created by: lumenthal-and sepe46 Mrs. Clinton 
or whether she was the original creator of the memos ap thiem to Mi fumenthal. What is 


abundantly clear is that sensitive memos between the Awo;,were’found- of the’Dark Web and in a 
foreign country. 


Thus, the above chart meets or-exceeds the objégfive aad mission ‘of the Phase I inquiry. Each of 
the items cited in the sample above could be ered:with:additional research and work, and 
then traced back to the cfeator. The momeét that this type of data, using these kinds of key 
words, phrases, hashtags, and addres e i i 

would become aware, anid thet E 


= 
While we: 2 


ot determine “tie ag Region where the computer is that links to IP address 
84.2322 


dan. epure@res-rd: x0. 
ad Rds|Residential, by 
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We also did a DNS look up and attempted to ping the computer to see if it would resolve. We 
found the following results, showing that the IP Address is genuine and is currently operating: 
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In real terms, every person today has a data fingerprint, much like a skin fingerprint. As people 
operate in the e-commerce world, the “Data DNA” of their digital fingerprint leaves an indelible 
mark that is rarely deletable. Spending patterns, financial transactions, telephone call pattern 
analysis, credit card transactions, travel habits, subscriptions to magazines and online computer 
behavior cannot be altered. While people often try to conceal or obfuscateyheir tracks, computer 
forensigs can be employed to detect their connection. 


Humans today translate into digital images, both structured and ungtructured. “Data, pictures, 
sounds| cyber visits — all of it compose a person’s data DNA’ that/s uriate to that'person. It 
looks something like the illustration belo 


d’s. dig ital content is unstructured or semi-structured, to include: 


yment'‘Teports that are both open and closed 
4 leases on the surface Web 

@ ebsites, both open and closed 

@ ALmails that are dumped into the public domain 


Semantic extraction is typically used to 


| @ Discover entities and identify their structural ownership and links 
@ Discover relationships between entities 

@ Discover events 

@ Taxonomy generation 

@ Categorize documents 
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i 
i 
2 A high-performance data-extraction system that consists of 


H @ A design-time compiler 

| @ A run-time engine 

@ A powerful /ntegrated Development Environment (IDE) 
@ Several utility programs 


4 Semantic extraction is typically used to 
| @ Discover entities 

| @ Discover relationships between entities 
| @ Discover events 
| f @ Categorize documents 


Technically, entity extraction operates somewhat in this ma 


information, if any, to the original source. Based upon the spreadsheets showing that several 
direct and indirect attacks were executed upon Mr. Blumenthal and Mrs. Clinton jointly, we 
focused first on Mr. Blumenthal’s background in an effort to identify the server location. 


| 
Sidney Stone Blumenthal born| 


b7c 
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Aside from his known AOL email address, Mr. Blumenthal also traces to 
(ee was also hacked around July 2015. b6 
T bic 
We checked another database? and found some of the reported IP addresses that were linked to 


Mr. Blumenthal’s email addresses, as well as his home address, based upon a search of his Social 
Security account number. The registry is abstracted below: 


Fiegs 


Addre: SSN; DOB 
seared aRaK mv Jalen [Sort [ww 


. bé6 
BUURENTHAL SIDNEY: 7C 
. Be zi a ___ a _—— 
[Fe] 


ion 


SLUNENTAL SIDNEY 


aka: SIDNEY 
BLUMENTAL 


Reported: 19/18/2011 


Reported: 10/06/2014 
Reporied eee _| 
| a a 
We also expanded the search to a scan of the addréss itsel J yee eg 
c 


We obtained the following results: 


Search Criteria 


dew: b6é 
ine < Fr 


Flags: Arests, Bankiiptcies, Crinvnal Records. Eviotors, CvL se Prolossinnal Licenses, Sey Otteriter Records, Tar Liens, Warrants: 


Flags 
Phone 
AR] BK]CR|EV[Ja|Pt|SO|TL 


b6 


SLUMENTHAL = b7c 


4x 


~02'28/1993 


* For additional information, please see Attachment #6[______ yd Blumenthal IP and SSN Scan b6 
| b7c 
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We created a chart of known or suspected relatives, friends, associates and acquaintances, based 
upon his digital profile, which is summarized at page 310-312 of the 0 james b6 
attached.’ bie 
Mr. Blumenthal is an American journalist, activist, writer and former political aide of President 

Bill Clinton as well as a long-time confidant to Hillary Clinton; and a journalist, especially on 

American politics and foreign policy. He was editor of several departments and wrote for a 

number of publications including The Washington Post, Vanity Fair, and The New Yorker. He is 

the father of Max Blumenthal who is also a journalist and political activist. 


i 

Mr. Blumenthal was born in Chicago, to Claire (née Stone) and Hymaft’Y. Blumenthal. He 
eared a BA in sociology from Brandeis University in 1969, and startedfAis cateer in Boston as a 
journalist who wrote for The Boston Phoenix and The Real Paper, twofalternativé weeklies of the 


day. Mr. Blumenthal resides in Washington DC but also has btfices and comnections to 
California and Chicago. oS 


Mr. Blumenthal has also used numerous iterations of his true 0 


SSN: 
| issued i 


' b6 
| b7c 
| 
! 
i 
8) BLUMENTHAL, SIDNEY 
SSN; 
== 9) BLUMENTHAL, SIDNEY S 
SSN: 
10) BLUMENTAL, SIDNEY 
11) SIDNEY, BLUMENTHAL 
Based upon our initiaVresearch, it appears that Mr. Blumenthal’s computer or server had been 
connected at; However, we do not know at this BS 
juncture whether hgused a lap top, desk top, or if the computer was portable (such as a device) at ie 
the time of the attack. 
We note that Mr. Blumenthal has a number of devices that he uses, to include phones, but this 
attack was not done upon a mobile device. Every indication is that it was a static and stationary 
- server, such as a laptop or desk top. We checked a numberr of databases and found that Mr. 
Blumenthal traces to a number of other addresses in the Washington DC area, to include: 
i 
}For addtional termation aa locations of Sidney Blumenthal, and his servers and email addresses, please see Attachment #1 SYD = 
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St 1997 until January 2001. 
ns and ‘public policy as well 


Clintons, and for attacks ersaries 
of staff, for President,,Ol gre ¢ holding a position in Hillary Clinton's 
State Department. / 


After the House ius fary ) ‘ee. ay(d the United States House of Representatives impeached 


to attest that it was Ms. Lewinsky who initially pursued the 
. Lewinsky stated she was the one who instigated the relationship. 


In 2008: \Mr. Blume fthal joined the Hillary Clinton presidential campaign as a "S 
in November 2007. While on a trip to advise Clinton on her presidential campaign, 


e find it curious that at Attachment #2, there is 
hich normally would be reported. It is possible that he was able to 
not an easy effort. 
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| 
After her January 2009 appointment as Secretary of State, Hillary Clinton wanted to hire 
Blumenthal. However, Obama's chief of staff, Rahm Emanuel, blocked his selection due to 
lingering anger among President Barack Obama's aides over Blumenthal's role in promoting 
negative stories about Obama during the Democratic primary. 


According to a report in the New York Times, "Emanuel talked with Mrs. Clinton ... and 
explained that bringing Mr. Blumenthal on board was a no-go. The bad blood among his 
colleagues was too deep, and the last thing the administration needed, he concluded, was 


dissension and drama in the ranks. In short, Mr. Blumenthal was out... 


f : 
Mr. Blumenthal, a longtime confidant of Bill and Hillary Clintoi, 4arned:about,$10,000 a month 
as a full-time employee of the Clinton Foundation. During the/2011 uprising in:Libya:agaja 
Muammar Gaddafi, Mr. Blumenthal prepared, from public an other sources, about: 25 afemos 
which he sent as email word attachments to Mrs: Clint i 


ectively, misplaced” in that our 
oup of intelligence professionals 
seeking to repatriate asset which, w 
hidden in various offshore Jécalities. 4 
the infamous Panama Papers law & é j has Tegently been referenced i in the news. This 


eats, ihe new Libyan coalition government had a strong desire to hire a 
group of professionals thé could identify other Gaddafi family assets plundered from the country 
which is suspected of Heing about $66 billion. Mr. Blumenthal touted his and his associate’ s 
ability to find the moyéy and thus become the preferred contractor for the coalition government. 


However, he needed “bait” to entice the State Department to release the data, using his direct 
contacts) with Hillary Clinton.’ Thus, the constant Libyan memos, which he and his associates 
crafted based upon information supplied to them by high-ranking coalition members. It was, 
consistent with one aspect of the FBI investigation, an example of an official guid pro quo. By 
giving Mrs. Clinton Libyan data as bait, he could justify his value and worth and in exchange 
obtain State Department intelligence on the Gaddafi money; and then with this valuable 
| 
$ For additional information, please see a small sample of memos sent from Sidney Blumenthal to Hillary Clinton that represent “bait” to 


entice State Department to release Intelligence file on assets recovered, Attachment #5 Sidney Blumenthal Sample Memos to HRC Regarding 


Libya j 
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classified intelligence; combined with the Libyan Central Bank intelligence use the combined 
files and data silos to track down the missing money for the coalition government. 


As an illustration of how profitable this Program can be, since the Blumenthal group had a 
contingency contract with the coalition government, if they found just $1 billion in assets®; and 
the contingency agreement was just 10% of the funds recovered (which is extremely 
conservative and considerably below industry standards), it would mean the group would earn a 
windfall of $100 million gross. 


erous, the net to the 
enthal and the money 
é. Clinton, his long-time 


Assuming expenses of 10% of the gross, which would be extremely get 
group would be nearly $90 million. The only obstacle separating Mr. Bl 
was the State Department intelligence; and the key to getting it was 
patron. 


For these reasons, we assess that the true motivation behind Mr/Blumenthat’s. willingness to 


to or actually obtain the State Department intelligence file, no 
be highly illegal for the file to be released to a private citizen, 


We also are aware that this team created a corporate 
agreement was crafted between the team and thi 
What we do not snow is whether the team >w, 


Above we opined the Bl 


Blumenthal's "intel was,shoddy i i itici ith simi 

names. In one instance, Blu Lian poias it among 
‘the most influential of thé Libyan prime minister’ 's new economi rs—without mentioning 
that Blum thal s advising ‘a. grodp of contractors = a potential business 


q Clinton regarding the Benghazi incident, as one of the alleged 
sources of. Hillary Clintgé’s intelligence. During this hearing Democratic members asked that 
Blumenthal's:depositior/transcript be made public so that comments regarding his involvement 
could be placed in-confext. The motion was defeated by a voice vote, followed by a roll call vote 
along party lines. 


Mr. Blumenthal has a dubious litigation history: In 1997, Blumenthal instigated a $30 million 
libel lawsuit against Internet blogger Matt Drudge (and AOL, who had hired Drudge) stemming 
from a false claim Drudge had made of spousal abuse attributed to "top GOP sources". Drudge 
retracted the story later, saying he had been given bad information. In Blumenthal v. Drudge, 992 
F. Supp. 44 (D.D.C. 1998), the court refused to dismiss Blumenthal's case for lack of personal 


* Published reports suggest that the Coalition Government believes that between $60 billion and $100 billion in assets was absconded by the 
Ghaddafi family and exfiltrated from the country and laundered. 
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jurisdiction. Drudge later publicly apologized to the Blumenthals. Mr. Blumenthal dropped his 
lawsuit and eventually reached a settlement involving a payment to Drudge over having missed a 
deposition. In his book, The Clinton Wars, Blumenthal claimed he was forced to settle because 
he could no longer financially afford the suit. 


We did a very basic scan on Mr. Blumenthal,‘ mostly in an effort to isolate the email addresses, 
IP addresses, and identity of devices that he was using to communicate with Mrs. Clinton. 


maintained in later years at various hosting companies. 


ae 
For purposes of this study, the issue is whether Mrs. Clinton’s:seyVer was impermissibly:entetad 
by unauthorized persons either before or after the ey, of Mr..B ‘umenithal’ s Server. 


Mr. Blumenthal’ S$ server was compromised and data wAs: ingHided fany emails, 
attachments, and other data which origi fro ¥. Mrs». Cli such’ persons would 


By way brief background, iy ome quarters of the legal community today, there are law firms 


involves filingactions aggist middle-level political, military and intelligence persons who, 
having plundered:.a natig treasury for personal gain, but no longer enjoy any form of 
diplomatic immunity» an Opposition Government had strong evidence that the Ghaddafi 
regime had absconde¢ with somewhere between $60 billion and $100 billion dollars using a 
number of devices, yéhicles and straw persons. 


As such, the Libyan’ Opposition Government was soliciting law firms and intelligence operators 
to assist them to recovery the missing money and repatriate it to the Government. 


* For additional information on Sidney Blumenthal, including location of his email accounts and servers, please see Attachment #1 SYD 

BLUMENTHAL Basi{ Report bé 

: b7c 
We note here that the evidence is in part subjective, but there are some objective clues that support this theory as a motive. Much of this 

section is based upon assessment by qualified intelligence analysts, but requires much additional research at Phase I! in order to either 

suiinstantivse this theory or set it aside. 
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There is information suggesting that Mr. Blumenthal, Mr. Tyler Drumheller, (deceased 2 August 
2015) born 12 April 1952, and Mr. William D. Murphy had formed a relationship whereby they 
contracted with the Opposition Government to try and identify, locate, and recover the missing 
money, in concert with a law firm that does this type of work® 


Mr. Drumheller, formerly the Chief of the European Division of the CIA, and following his 
retirement created a private intelligence gathering service. 


Mr. Drumheller and Mr. Blumenthal have a long-time relationship that goes back to at least 
2007, when Mr. B heller had information from a 
source identified as} 


for the need to invade Iraq, at least according to r 
Drumheller, who claims the intelligence came fro 


possession, combined with what he could obtain 
Opposition) he could sling shot ahi f the opp 


bYan Central Bank data from the Libyan 
in in indie the missing treasure.” 


Assuming that another $20’ billion was 
and his colleagues could wsé the hig itsAE, Moravia to freeze just $1 billion of the $20 billion 


byan government, either directly or indirectly (via the State 
€'US taxpayers do not have to fund. 


ce_to_indicate that_a on_identified_as| 


' While Mr, Murray has a long-time relationship and connection with sources in the Middle East, partly as a result of his long-time service at 
the CIA as a Senior Executive Officer, but also through his company Alphom Group, LLC. However, the Rogue Judgment Recovery Work 
assignment, it is believed (no sourcing) was not done through Alphom, but through some other offshore vehicle. 


‘as several other companies, to includ] ind 
elsewhere. A full brief can be provided on him as necessary, b lissent who 
has been a naturalized citizen in the U: nm 10 the 
1990's and was actually covered a [_ she 
was| His primary employer as|__________Jat the time wa SCS +d As such, he was 


also a self-styled liaison from the State Department to a number of US-based intelligence services owing to his experience in the Middle 
East. A full brief on him can be done, as necessary. 
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This person began the solicitation process on approximately January 25" 2012, claiming that he 
was dealing with representatives of a “high level political types in the US within the State 
Department” and that he personally had top-level contacts within the new Libyan Opposition 
Gover : \d have a contract to assist in beginning the repatriation process. 

Proof of involvement in participating in the program, and seeking the 
guidance of others, is found in this post-meeting summary memo that was sent to him: 


v regarding Qaddafi plundered ‘assets; the 
gh, pony not inspire a lot of faith and credence 


never overtly states that he i ageatg 
memos clearly €9 contain Jan; 


As recently as 201 
had a direct contr 


aracterizing the level of access, and the placement of HUMINT 
(ple ‘unconnected HUMINT and compartmented intelligence is a 
dubious practice. +e ¥ Officers simply do not craft SITREPs or presentations using these 
kinds of characterizati Oke 


Rather, the ese memos is that it is being done to “shake and bake” and provide Mrs. 
Clinton fodder forArguing that an exchange of data might inure to the benefit of the US (looking 
at it in the light most favorable to the parties implicated) Community and the American people, 
as well as the Libyan Transitional Government who were totally reliant upon US funding and 
strength. 


* Indeed, unbeknownst to this author at the time (January 2012]| ___vas ~ it is now suspected — trying to assemble a team of, 
is jel CIA operatives with Middle East experience to help him round out the “technical team”. In January 2012] 
lid not state to this author that he was working directly or Indirectly with Mr. Blumenthal; only that he was part of a team 
being assembled, that they had a contract, that they had a funding vehicle for needed seed money, that they had a Chicago-based law firm 
and that all members were former USG Intelligence Operations Directorate personnel. 
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b6 


CO Fhas a rather controversial history within the US Intelligence Community, b6 


particularly aL SSCSS~C*Wdis links to ihe 


Notwithstanding his reputation in the Intelligence Community, 
highly placed contacts within Libya which could have been mined for creation of a Rogue 
Nation Asset Recovery program, but for his limited technical and intelligence analyst resources. 


Is it a stretch to believe that at one time or ol not stumble upon Mr. ee 
Blumenthal, Mr. Drumheller and Mr. Murray, who were creating the “shake and bake” SITREPs, be 
and for which he would provide access to the Opposition Government to contract for recovery of 


the plundered Qaddafi assets? While the time line and the relationship, Zonnections, links and 
possible association atmospherics do fit; it is still just circumstantial at pyésent. 


id. ré2patriot the money, it 
they suppressed the money, 


But, so goes the possible theory — If Blumenthal was able to locate A 
would be a huge win for the US State Department as it could clai¢ 
laundering efforts of the Ghaddafi family and repatriated:the mg 
moreover, saved the American people the cost to furi 
repatriation effort. 


Again, we caution here: We nave no defi inti 
involved in the above engagement with.the 


national j Ae know that Mr. Blumenthal was passing to Mrs. Clinton 


dubig ke acterizing as atmospheric HUMINT reports from alleged 
eG iience Sources in bibya®/As stated above, we also know def laetinncly Be 


did have a contract with the gppésition Government as recently as around 2014, according to his bie 
self-confessed claims. e : 


Further, we. also know that the Libyan Opposition, as recently as December 4" 2015 was seeking 
to re-ignite this progyam using a man identified a Our information b6 
suggests that| 77 __ was working directly for the new Libyan Foreign minister “on an BIC 


initiative to locate “and freeze Libyan assets that were hidden by Kaddafi around the globe.” He 
also stated “...Until the political situation in Libya becomes stable and a democratic government 
is lected, all these assets are in danger of being squandered or misused by politicians or treasure 
hunters.” 


“The email address fof ___|is identified in December 2015 | b6 


b7c 
z nal information on this event, please see abstracted and a truncated version of an email dated 4 December 2015 fron{___] 
seeking to partner with a local law firm to recover assets. Attachment #8 LIBYA ASSET ROGUE NATIONAL JUDGMENT 
RECOVERY PROGRAM 
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started several private 


| has been’ active j arthe Livy revolution since its inception in Februa 


is’acfve in Washington DC’s political circles with extensive networks and 
relationships about Libya and its democratic transition. He frequently participates in programs in 
prominent think tanks and meets regularly with policy makers and government officials 
regarding Libya. He maintains strong relationships with important political actors in Libya and 
continues to advise successive Libyan governments regarding Libya-US relations. 
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b7C 
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b6é 
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b6é 
b7C 


b6 
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b6 
b7c 


b6 
b7c 


a 
Po  Cittrently,"he owns and BIC 


b6 
b7c 


maintains an extensive network of contacts in Libya: 
political leaders and civil society groups. 


to recruit American Senior Intelligenc ,apatysis 
a Government arid seek to reCover/the assets, and did so a recently as 4 December 


ecommend that it might be worthy to make contact with the 
And ‘see: whether the Libyan Opposition Government ever 
érganizations or individuals and received reports, memos, work 
ehicles, etc., regarding asset repatriation, without regard to the 


aforementioned organizati 
contracted with, any grouy 
product, contracts;..corpor 
Blumenthal group. 


Normally, i [| __—(f£ ______]}had indeed hired a new group of forensic financial experts or b6 


Senior Intelligen¢e Afalysts, this follow-on organization would ask for copies of all memoranda. Bie 
They would want té“have this so not to duplicate past efforts that proved fruitful, or mine the 


data that was recovered for additional leads. If on Government did indeed 
contract with Mr. Blumenthal, it is logical thai has the ability to obtain the 
data. 
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While we cannot state for certain at this juncture in the research, that Mrs. Clinton’s server was 
directly penetrated, we did find a sample of a particular document within the Dark Web that 
traces back to her exact IP address where her domain email server was located. This document is 
a summary of known and suspected Libyan terrorists who were in and around the Benghazi 
area.'* If genuine, this document would enjoy the highest level of classification because it could 


be used for targeting and would be a record that the Ambassador-in-couny 


yy would have access 
to as it was probably obtained by the Chief of Station or an Operayfons:,Officer under his 
authority. : 


Moreover, this document was not found on Mr. Blumenthal’s sérver so it,was:not senit,by him to 


anyone and was not received by him from any source. 


On,in the world, and costs depend on the name, address, age 
To-date, we have processed over 20,000 GlobalScans since 


Since we have much expeylence in’complex digital intelligence research that involves databases 
and ele¢tronic sourcés, experience has shown that the only effective way to conduct such a 
study is the Global Scaff® on each person or company or document that we find and trace it back 
through the movemerf-evolution. 


We assume perméssible purpose exists for conducting all appropriate database searches. This 
matter must be confidential and privileged and done pursuant to the privileged communications 
doctrine and the attorney work-product doctrine. 


® For additional information on a sample of one file that was recovered from the Deep Web and the Dark Web which came only from Hillary 
Clinton Server, please see Attachment #2 COPY OF LYBIAN JIHADIST TRACED TO CLINTON SERVER EMAIL 


™ Please note that some searches require a permissible purpose as defined under the Federal Fair Credit Reporting Act, Title 15, USC 1681, 


et. seq., as well as other local, state, federal and international laws. You are required to {_fhat any search is in compliance with b6 
both FCRA, as well as the 1999 Graham-Leach Bank Privacy Act. By placing any order {the client represents that the client has fully b7c 
complied with all local, state, federal and international laws and assumes all responsibili umes no responsibility for determining 
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However, as stated at the outset, the only exception to the privilege when using Global Scan is if 
records are found that are demonstrably apparent to be classified, even if not overtly marked as 
such. If this is found, we must stop, turn over the implicated material to the FBI, and seek their 
guidance and support. 


This search permits us to cite the costs for obtaining all other information within each 
“information corridor” that may be identified during the initial scan. 


It also enables the ultimate client to maintain control of the scope, direction, and cost of a more 
extensive investigation. Each proposed search item is listed at the end of initial report. 


For example, a Global Scan® will cite the name and address of a bank/an account number, the 
signatures on the account, and when it was opened, but will not proyide information regarding 
balances or activity. However, the Global Scan® will cite the exact/cost for,obtaining that next 
level of information. ‘ a 


Corporate affiliations, executive associ 


Credit reports and personal financial scans: 


fats, mechanized equipment, and recreational devices traced to merchant’s name, 


ame: of the merchant, based upon a scan of the person’s name, 
iple secured search. Included is both debtor and secured party 


UCC filings recorded in th 
SSN, or'past addresses, a, 
searches. yf 


j. “Identification ‘of tragé creditors, credit card companies, utility companies, banks, or other 
entities that the target would be paying with some type of instrument. These searches do not 
include identificayfon of the bank that a check is drawn upon, or the account number, just 
the bill that is befng paid. 


k. Identification of telephone numbers, cellular numbers, and mobile telephone numbers; 
together with long distance carriers. This search does not include a detail of the numbers 
dialed, or the subscribers to the numbers dialed, which can only be obtained at the next level 
of searching. 


1. All past addresses, historic use of addresses, names of relatives, names of persons traced to 
addresses used by the merchant, names of relatives and the statistical identifiers of those that 
reside in the same household as the merchant. 


whether the client is in compliance with these laws. We are not a Consumer Credit Reporting Agency and all of our reports are done as an 
agent to counsel under the Attorney Work Product Doctrine. 
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In actuality, the data flow appears something like that which is depicted below: 


seek to hav aranteed fee struct 
be prepared equires that all ci 


[_]does not bill by the hotin,for its 


robes, depending on the requirements of counsel, the permissible 
ion, etc. In addition to the above mentioned eight categories of 
in _ circumstances provide a more in-depth report and other kinds of 
‘ost for each depends on the nature of the request. We checked Mr. 
and found some or all of these indicators are present: 


1. Socjél Security Numbers and DOB Search 


2. Social Security Trace for all addresses, verify date of issuance, state of issuance and 
whether used regarding banking, financial or credit transaction 


3. Date of Birth Records 
4. Death Records 


5. Change Of Name Records 
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6. Marriage and divorce Records 

7. Criminal Records State or federal sealed or unsealed felony or misdemeanor 
8. Warrants of Arrest 

9. Order of Protection, domestic violence offender scans 


10. Probation Records, special offender searches, including sex offender registries, or 
habitual offender status 


11. Property Tax Records 
12. Utility Bill Records 

13. Current Address % : 
14. Driver’s License Information 


. Car Insurance Records 


Credit Records», / 
. Banking, fin ial and credit relationships that include name and address of bank 
»26. MVR Répofts 

27TAG & HIN Traces 

28. License Plates (Name and address can be found by doing a license plate search 


29. Full Driving Records, including searches of National Major Offender Database 


30. Military Records Search, including discharge status, branch job and rating, dates of 
Enlistment, Reasons for Discharge 


31. List of Hospital admissions and possible diagnosis codes 
32. Telephone Number Historical Index 
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33. Cell Phone Trace 

34. Unlisted Phone Numbers Decodes 
35. Illegal Alien Database Scan 

36. Government Job Registration Scan 


37. Worker’s Compensation Settlement or Claim Scans 


38. Automobile and Personal Injury Insurance Fraud Database 
39. Real Estate, Co-Op and Full Title Search scan for 50 yeays 


40. Leads for identifying hidden or secreted assets that aye in the form.of Trays, bonds, 
stocks, "offshore" bank accounts, or funds in.tax haven. countries 


41. College Records Search, verification of, college attendance, degrees co) Syed and 
special awards > 


42. Terrorist or Cult Member Dossiers 
43. 
44, 


ans, including whether cited in an adversarial 
ion by others 


By way of background, the “Deep Web” — a vast reservoir of Internet content that is 500 times 
larger than known “surface” World Wide Web material. What makes the discovery of the Deep 
Web so significant is the quality of content found within it. Deep Web searches are intended for 
cases where historic data needs to be obtained and which otherwise tends to “fall off’ current- 
day data tables. 
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Searching on the Internet today can be compared to dragging a net across the surface of the 
ocean. While much can be gathered from the top, there is a wealth of information that lies 
deeper, and therefore is missed by the average person. 


There are hundreds of billions of highly valuable documents hidden in searchable databases that 
cannot be retrieved by conventional search engines. The reason is simple: basic search 
methodology and technology has not evolved significantly since the inception of the Internet. 


Traditional search engines create their card catalogs by spidering or crawling “surface” Web 
pages. To be identified, a page must be static and linked to subsequent other pages. Utilized in 
this manner, standard search engines cannot “see” or retrieve content infhe,Deep Web and the 
crawlers used by them cannot probe beneath the surface. The result is tat enormous amounts of 
data remains untapped and effectively “hidden” to the crawler, while jA‘reality, the material is in 
plain sight. ’ 


The discovery of the at Ae Web is the result of sroundbreaiang deatch hohe develdip eds 


ing dozens of.direct queries simultaneously 
< archers to dive déep and explore hidden data 


information on 
commodity of thi 
immeasurable, 


blic information on the Deep Web that is 400 to 550 times larger than the 
comimonly defiried World Wide Web; 


2. 7,500 terabyte hs information, compared to 19 terabytes of information in the surface Web; 


3. 550 billion individual documents compared to the 1 billion of the surface Web; 
4. Information from an additional 100,000 Deep Web sites; 


5. 60 of the largest Deep Web sites collectively contain about 750 terabytes of information — 
sufficient by themselves to exceed the size of the surface Web by 40 times; 


6. On average, Deep Web sites receive about 50% greater monthly traffic than surface sites 
and are more highly linked to than surface sites; however, the typical (median) Deep Web 
site is not well known to the Internet search public; 
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7. The Deep Web is the largest growing category of new information on the Internet; 
8. Deep Web sites tend to be narrower with deeper content than conventional surface sites; 


9. Total quality content of the deep Web is at least 1,000 to 2,000 times greater than that of the 
surface Web; 


10. Deep Web content is highly relevant to every information need, market and domain. More 
than half of the deep Web content resides in topic specific databases; 


11. A full 95% of the deep Web is publicly accessible information — not subject to fees or 
subscriptions. 


To put these numbers in perspective, we estimate that some of the largést search ¢ngines, such as 
Northern Light, individually index only 16% of the surface Web. » they aré-missing the 
Deep Web, Internet searchers are therefore searching only 0, 03% (— or one: in,3,000:— of the 
content available to them today. : 


Clearly, simultaneous searching of multiple surface ‘and 
comprehensive information retrieval is needed. 


simultaneous searches. We have also developed a a query ‘engine translatable to 
about 20,000'sites, already collected, eventually, gro 
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During the past several years, the Department of Defense, led by the Defense Advanced 
Research Projects Agency (DARPA) has been steadily working on a project called the NOISE 
database, known as Name Only Index Searching and Exception. The acronym NOISE came 
from the negative consequence of conventional searching of the Open Source, Web-enabled 
applications such as: 


oogie.com 
y.cuil.com 
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os, e 
Traditionally, these are “Name Only”:..or, “Business N ly” or P&etephone Number Only” 
searches that return massive, unrefined results. e search critetia is common, the return 
results is often “NOISE” and burdens:the analyst vast amount of irrelevant information. 


Bs 


In the commercial or legal’ markets E, the 
obtain results quickl ; 


is trie, but the pressure is even greater to 
i hin ¢easonable budget. 


The commercial versio 
litigation such as the 
to be gleaned ; 
converted fof use 6 


sles th, NOISE application and the ee searches be 
lered here’ because Y latively common names of Advantage and the key individuals. 
It is the union of the'NOIS Ps clication and the restricted access data within __|that is 


only available with a ‘pofmnissible purpose that allows for a highly relevant, targeted search 
approach. It looks sort ing like this: 


nton, casé. It has been used to “walk back” information claimed 
urcesfas it can be fished out of the Deep Web and effectively 


col 
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a 


A 


data about a person (All known names, dates of bi ages, past “dieesses phot / fumbers, 
faxes, email addresses, web site addresses, businesses, es/ of relatives,*etc. the so called 
digital fingerprint of a person, and inject that intelligence fo the Web-enal application for a 
more definitive results. 


-000'to 120.'M 


For common names, the leads are culled down, i oreover, the data is 
highly accurate and is considered sifle-shot searché use ‘the name Hillary Clinton or 
Sidney Blumenthal are so common: gefis of stories and hits; this is the perfect tool 
to cull through the mountains + dat th. within the Deep Web. 


The second compelling réagon this 3 ch technology was developed is that the 
Internet and the Deep. Web:is patch large) “and vaster than any database source on the planet 
today. The “Deep Web”, sdmetimes kpown “as nternet Dark Space or the Deep Web 
Intelligence Center, is-d“vast resérvoiy/of cont at is 1,000 times larger than the known 
“surface” World Wide-Web. What mékes th scovery of the Deep Web so significant is the 
quality of cosr€nt found within. In #Very real way, the Dark Space of the Internet is much like 
the outey-space: Its depth’and ize Fnot trigasureable, indefinable, and endless. 


something like this: 


However, the new way, including use of NOISE and[ data that can be 
granularized, looks something like this: 
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access restricted 
with a permissip € 


of information that is deep, and therefore missed, hence, the Deep 
Web. The“ teason issfmple: basic search methodology and technology have not evolved 
significantly sitice..thy inception of the Internet. Traditional search engines create their card 
catalogs by spidering/or crawling “surface” Web pages. 


To be discovered, the page must be static and linked to other pages. Traditional search engines 
cannot “see” or retrieve content in the Deep Web. Because traditional search engine crawlers 


cannot probe beneath the surface, the Deep Web or Dark Space of the Internet has heretofore 
been hidden in plain sight. 


The Deep Web is qualitatively different from the surface Web. Deep Web sources store their 
content in searchable databases that only produce results dynamically in response to a direct 
request. But a direct query is a “one at a time” laborious way to search. 
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NOISE automates the process of making dozens of direct queries simultaneously using multiple 
thread technology, and takes private, non-pubic financial information and pulverizes it for 
inclusion into the search query. If the most coveted commodity of the Information Age is indeed 
intelligence, then the value of Deep Web content is immeasurable. 


Today, more and more people are “self-confessing” their habits and haunts; their biases and 
prejudices and their flavors and peccadillos. It is most predominantly done on such Social Media 
web sites as Facebook, MyLife, LinkedIn, and hundreds of other public and private chat portals. 
All of these locations are trawled, but the key is the search instrument or vehicle used and the 
advanced analytics applies. 


Our technology specializes in the developing of these wide and deep dita mining:nets and tools, 
where it is launched upon an endlessly sized ocean of data. Some of hese data souréés include: 
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sWord protected, an¥encrypted server domain. The data than moved to a second 
sthat'does ‘not appeat/to be.controlled by Guccifer. This is troubling because it 


Prima facie evidence, of a/folling spill that, at least in part, included data that directly or 
indirectly originated from thy’computers or servers of Hillary Clinton and Sidney Blumenthal. 


This Romanian domain }dcality than collected nearly 37,000 files and hosted them for a long 


period of:time, many ofAvhich came from a direct attack upon the server of Mr. Blumenthal, but 
also include:direct attgCks of others. 


One of those pers6ns is believed to be the email domain server of Mrs. Clinton because one 
document was found on the Romanian domain that traced to the IP address of Mrs. Clinton, and 
one document was recovered successfully, but many others could exist. We just do not know 
because in order to definitively determine this, one would need to download all of the 37,000 
files, and then open each to see whether any can be directly linked to the Clinton server. 


The Clinton security people claim that “security logs of the server show no successful 
penetrations or attacks.” This statement or assessment is without basis in our opinion. In reality, 


one cannot determine from internal security logs alone whether a sophisticated pernicious attack 
was executed. 
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There is a multitude of ways that a penetration and exfiltration can occur and no trace is found 
within the internal security logs of the targeted server. This includes direct, indirect and 
collateral attacks upon the email domain server, such as was most likely done here. 


It is inescapable that a security breach and a violation of basic server security occurred here, both 
with Mr. Blumenthal and Mrs. Clinton. 


The State Department and the IC basic security protocols regarding email servers for personal 
use was also systematically violated by Mrs. Clinton. The fact that we found emails regarding 
attachments that describe the names and identities of targets for attack in Libya that date to about 
the time of the Benghazi attack is particularly troublesome. Such a docyfiient, if authored by a 
US Government employee who enjoyed original classification authority/would:enjoy the highest 
level of classification, most probably Top Secret - SCI and a S de. The, fact that this 
document was found in “the open” and has no security classification, s highly:suspect and 
deserves critical review and analysis. : : 


a domain server outside of the US. 


The answers to each of these questio 
to determine whether more record 


ig softwafe. We believe that Mr. Blumenthal team members made clear that 


he would need: 


(a) The ‘complete financial database image files of the Libyan Central Bank 
during the Qgddafi years; 


(b) The complete State Department intelligence file containing all information on 
how they identified, located, and then seized the Qaddafi money; 


(c) The complete Qaddafi CINFIN file to which the State Department would have 
access; 


(d) Identification of the corporate vehicles created by the Qaddafi family to 
exfiltrate the funds. 
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If Mr. Blumenthal were able to obtain all of these records, it would then be possible for the team 
to perhaps succeed in tracing the funds to their present day location and use a legal team to 
commence seizure proceedings using the Moravia Writ legal method. The potential reward to the 
Blumenthal team would be tens of millions of dollars, but depended entirely on his ability to 
leverage his relationship with Mrs. Clinton. The plot was disrupted when the email server, and 
the memos (samples of which are found at Attachment #5) became public. 


The bottom line here was “No Data - No Dollars”, and absent this political quid pro quo, the 
team’s efforts would be doomed. 


In addition to the above, the Phase I Study resulted in some other detaifed findings that are best 


summarized below: 


1, The computer of Sidney Blumenthal was positively identified as hosting imfny emails and’attachments 
originating from Hillary Clinton’s server and others from the:Cliiton/Foundation, In Phase I, we: 
recovered at least 20 memos from Mr. Blumenthal to Mrs. Clinton that contained Situation Reéports 
(SITREPS) allegedly based upon intelligence sources in Libya.” % 2 


2, Mr. Blumenthal’s server was successfully attacked by Marcel Laz; 
who is also known as Guccifer or “Small Fume”. 


¢ Mr. Blumenthal’s ‘server was transferred to the 
-Yi (Bucharest Time), and yielded many references to 
yoest that the contént of the computer traced to IP 
ine/else who accessed his server. The reason is that this 
identified;, arrested, and incarcerated in Romania, 
Several possible ee ist: ‘cifer had a co-conspirator that continued to operate the 
: (b} The compute ooine, this collecting 


computer at 84.232.210.154 on July 5” 2014 
“HRC” within the spreadsheet. This wos 
84,232.210.154, was nét Guccifer, bye 


rom botli:the Blumenthal computer and the Clinton email server 
computer tied to IP 84.232.210.154, both of which were located 


Outside ‘of the United: ‘States. 
either contained overtly:cla 
, Counterintélligence conce 


ind of,interest to the Community. 


6. “ Guccifer entered the Blufienthal computer several times, first through Blumenthal’s AOL account. It 
is hot clear whether Gyce/fer targeted Blumenthal because he represented an opportunity of interest, 
or because a foreign xervice directed him to the account. Also, it is not clear whether the account was 
entered after he firsfentered the Clinton server or that of someone else on the Clinton domain server. 


7. During Phase Ii 


uch additional information can be obtained on the sequence, timing and chronology 
of when the tw; 


‘servers in question were accessed and in what order and how many times, 


8. We found indications that Guccifer or person or persons acting on his behalf or persons impersonating 


Guccifer did a secondary penetration of Mrs. Clinton's server on May 22, 2009, and other penetrations 
thereafter, 


9. We confirmed that Guccifer used an anonymous server located in Russia to conduct the penetration, 
and therefore, there is a high possibility that the Russian services that monitor these anonymous 
servers likewise have a copy. 
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10. One file that was found on Mrs. Clinton’s server was not found on the Blumenthal server. This file 
represents a major loss to the Intelligence Community because it appears to be targeting data, The 
data is first in Russian and then converted to Arabic, It represents a list of targets that quite possibly 
was created by a Russian source, located or intercepted by our services, and transmitted to Mrs. 
Clinton by some unknown person. The file then left her server and was found in the Deep Web and 
Dark Web. 


11, The above cited file, an excel spreadsheet, we assess, would enjoy the highest level of classification if 
submitted to a person who has original classification authority. The file was found stripped of its 
collars (if they ever existed). If it is determined by the FBI that this file ever was overtly classified, it 


will serve as a potential “smoking gun document.” 


Guccifer penetrated a number of targets and we recovered over 37,000 files from a 
IP 84.232.210.154 that he obtained. We created a mapping of those files as the; rin the Deep 
Web. We then tested the spreadsheet and the content behind the spreadsheet (he 37,000. files) using 


nos Sent to Mrs. Clinton were opened recovered in original 
alysis by counsel, Most all were word documents and related to a 
¢ provided to counsel as a means to substantiate the claims of Guccifer. 


», We did not actually ect the’ content of Mrs. Clinton’s server or the content of computer 

'84.232.210.154 at:Phasc J, we merely validated the major premise and hypothesis that data originating 
Clinton and Blumenthal servers were attacked, directly or indirectly, and 
side of the US to Guccifer; and then migrated to computer IP 84.232.210.154, 
by unknown persons, Additional research is required to cull through the 37,000 


15, We note that there are profound legal questions regarding Phase II because it is not clear what our 
obligations may be regarding recovery of potentially classified data that may or may not contain actual 
collars that overtly show the content was classified at the time they were sent to Mrs. Clinton; or emails 
and attachments that were retrospectively classified but were released in truncated form. Our 


recovery of such content would be untruncated and in original condition. 


16. It is conceivable that one possible motive for Mr. Blumenthal’s decision to feed Mrs. Clinton the 
SITREP reports was to promote his group as a quality private intelligence group in Libya capable of 
obtaining detailed intelligence from various unnamed, disparate sources as to the thinking, actions, 
planning and intentions of key operators in the region. We do not opine on the accuracy of the 

nce provided, only the tone and intent of the memos, Our assessment is that they are 

essentially, crafted as “shake and bake” intelligence assessments, done to promote a need by the 

Blumenthal group, and not to turnover information because of some legal or moral obligation. 
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17. 4 iactive evidence_to_ indicate that_a_ person identified as| 
telephone 10 Jarry DOT WT Bre 


to solicit Senior Intelligence Analysts with experience in repatriation of assets plundered by 
the Qaddafi family. This person began the solicitation process on approximately January 
25™ 2012, claiming that he led was dealing with representatives of a “high level political 
types in the US within the State Department” and that he personally had high level contacts 
within the new Libyan Opposition Government that he would have a contract with to begin 


the repatriation process. 
ence Community, b6 


18, has a rather controversial histo: 
particularly a His links ta as one of b7C 


the prime operatives in Libya. Notwithstanding his reputation in th¢ US Intelligence 


within the US Intelli 


een mined for creation of a Rogue Nation Asset Recovery progra: 
technical and intelligence analyst resources. 


Phase If 


The proposed Phase II study includes: 


1, Recovery and sorting of all Guccifer data on the server ip 


aps the secret server substantiates this claim, 
Guccifer server. 


The spreadsheet that we obtained 
assuming a portion of it origingté 


ssfs of Mrs. Clinton and her colleagues who used this server 
‘hether any content traced back to the server or the email 


‘The regovered data contgft,needs to be date stamped and placed in a chronological arc to 
q triangulate against the gftivities of Mrs. Clinton, particularly around the time when she was 
dealing with the Benghézi investigation. 


7. Counsel needs to gétermine from quality counsel with National Security experience and 
intelligence experfs, the legal obligations by cleared persons to report and surrender data 
that may:have. y rertly labeled classified data; or data that would objectively be considered 
classified had € been hypothetically subjected to a person possessing original classification 
authority. 
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e Why did you create the email archive? SPRING 2013 


° 


° 
° 


Confirm date of creation [believed to be March 2013. In addition, we see HDR22 
accessing mailbox from a Mac from 3/23/13 — 4/1/13.] 

Why both a laptop computer and a thumb drive? 

Who instructed who to create it? 

Who helped her create the archive? Did you work with Bryan Pagliano or Justin 
Cooper to create the archive? [previously mentione: — wrong time 
frame] 

Who gave you the login credentials/password for HDR22? 

Was that the first time you logged in to the mail account? If not, explain. 

Did anyone else ever log in to her mail account (Huma, etc.)? 


Did you access the mail using the Macintosh Mail application or via webmail? 


How did you create the archive? How did you save it (i.e., files on your laptop, 
thumb drive, CD, kept in the Mail app)? Where did you save it? 


Did you, or someone else, delete any emails from Clinton’s active mailbox after 
this transfer was completed? 


Did Clinton change her address from hdr22@clintonemail.com to 
hrod17@clintonemail.com before OR after the archive was created? 


Who, if anyone, had access to the laptop until you sent it to PRN? 
= Did anyone request access? 


After you downloaded the emails to the laptop, did you use the laptop? 
After you downloaded the emails to the laptop, did you ever access the emails? 


° Do you remembel___ khowing you how to access this archive remotely? 


° 
; 2 
° 


What did this archive look like? On what computer did you access this archive? 
Do you recall the steps? The password/login credentials? 
Did you provide these credentials to anyone else? 


e From where did you purchase Clinton’s BlackBerry devices? 


e What source document did Clinton use to write her State memoir, Hard Choices? 
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o Who helped her create the archive? Did you work with — Pagliano or Justin 


co Who instructed who to create it? 


b6 


wrong time a 
Cc 


Cooper to create the archive? [previously mention 
frame] 


o Who gave you the login credentials/password for HDR22? \C. How did 


Acces. “tre: 


o Was that the first time you logged in to the mail account? If not, explain. actiunt- 
o Did anyone else ever log in to her mail account (Huma, etc.)? 
o Did you access the mail using the Macintosh Mail application or via webmail? 


o How did you create the archive? How did you save it (i-e., files on your laptop, 


thumb drive, CD, kept in the Mail app)? Where did you save it? 


o Did you, or someone else, delete any emails from Clinton’s active mailbox after 


this transfer was completed? email cn anged before Anthive . 


o Did Clinton change her address from hdr22@clintonemail.com to wore 
‘hrod17@clintonemail.com before OR after the archive was created? 
o Who, if anyone, had access to the laptop until you sent it to PRN? i sia Was (+ 
= Did anyone request access? red In the 


o After you downloaded the emails to the laptop, did you use the laptop? Seeured ? 
o After you downloaded the emails to the laptop, did you ever access the emails? 


« Do you remembef______ khowing you how to access this archive remotely? A 


o What did this archive look like? On what computer did you access this archive? b6 
co Do you recall the steps? The password/login credentials? b7c 
o Did you provide these credentials to anyone else? 


© From where did you purchase Clinton’s BlackBerry devices? Are) ower 7 


What source document did Clinton use to write her State memoir, Hard Choices? 
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From: 

Sent: Friday, July 01, 2016 1:04 PM 

To: IF) (FBI) 

Ce: 

Subject: mails 

Attachments: Email 2.10.2014. pdf, Hanle' mail 2.11.2014.pdf;, a 
.23.2013.pdf, Hanley 0.7.2013.paf; St aera 


-16.2013.pdf 


b6 


Dear Special Agen{__| as requested, attached are copies of Ms. Hanley’s email communications wit] 
[peat to the laptop/email archive matter. Please let us know if there is anything else you ee bic 


apologize for the delay in sending this, but | was out of town earlier this week and just returned today. 


b6 
b7C 


View Biography 


CONFIDENTIALITY WARNING: This email may contain privileged or confidential information and is for the sole use of the intended recipient(s). Any unauthorized 
use of disclosure of this communication is prohibited. If you believe that you have received this email in error, please notify the sender immediately and delete it 
from Your system. . . 
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M Gmail et, a 


HRC emails ; ' 


20 messages 


Mon, Feb 10, 2014 at 8:55 PM pe 
Tol b7c 
Ce 
H 
lam no longer with HRC's oficd it | wanted to try to finish the HRC email project 
which requires sending all of her archived email to your server. You recall that we couldn't figure out a way for you 
to connect to the laptop that | have in my possession. 
Do you have time to try tomorrow? Last time, | tried from HRC's home but tomorrow | can try from my home, 
which has good wifi. 
I'm adding___for her situational awareness[_ as soon we've transferred the email, I'll figure out a way 
to get the wiped laptop to you. 
best, 
Monica 
Mon, Feb 10, 2014 at 9:02 PM b6 
b7c 
| should be able to work with you on this tomorrow morning, can we shoot for around 11a EST? 
From: Monica Hanley [mailt b6 
Sent: Monday, February 10, 2014 8:55 PM Ric 


Subject: HRC emails 


[Quoted text hidden] 


This email has been scanned for email related threats and delivered safely by Mimecast. 


1 of 6 HRCS2o2I™ 


Gmail - HRC emails https://mail .google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


For more information please visit http:/www.mimecast.com 


Mon, Feb 10, 2014 at 9:03 PM b6 
b7C 


sounds great 
if tomorrow falls through for you, we can find another time. Will email you in the morning. 
[Quoted text hidden} 


Monica Hanley Tue, Feb 11, 2014 at 11:00 AM b6 
Te b7C 


does this morning still work for you? 


[Quoted text hidden] 
Tue, Feb 11, 2014 at 11:08 AM b6 
To: Monica Hanle\ b7Cc 
Sure thing 


Can you fire up the Mac that has the emails on it, and go to this address from that Mac ? 


https://broker.gotoassist.com/h/citrixassist? Question=DR077-267-692 


From: Monica Hanley (maitf S—isd % b6 
Sent: Tuesday, February 11, 2014 11:00 AM b7c 
To] 

Subject: Re: HRC emails 


[Quoted text hidden] 
[Quoted text hidden] 


Monica Hanle: Tue, Feb 11, 2014 at 11:11 AM b6 
To} b7C 


done: let me know if you can see the screen 
[Quoted text hidden] 


b7c 


20f6 FREED 
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b7c 
Monica, | can see your screen now. Can you call me real que] | 


From: Monica Hanley [mailt b6 


Sent: Tuesday, February 11, 2014 11:00 AM b7C 
Tof 


Subject: Re: HRC emails 


does this morning still work for you? 


[Quoted text hidden] 
(Quoted text hidden] 


Monica Hanle Tue, Feb 11, 2014 at 11:18 AM b6 
T ; b7c 


[Quoted text hidden] 


Tue, Feb 11, 2014 at 12:28 PM b6 
To: Monica Hanle b7C 


Monica, my remote session disappeared, maybe the laptop went into sleep mode? 


From: Monica Hanley [mailt b6 
Sent: Tuesday, February 11, 2014 11.18 AM b7c 
[Quoted text hidden} 

[Quoted text hidden] 

[Quoted text hidden} 


mon| Tue, Feb 11, 2014 at 12:34 PM be 
To: b7C 


will check I'm out but headed back to the apt now 
[Quoted text hidden] 


Tue, Feb 11, 2014 at 12:34 PM PS 
To: mor b7C 


No worries, let me know when you can get back over there to power it up 


3 0f6 : 6/23/16, 3:29 PM 
HRC-2244 
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b6 
b7Cc 


From: mon [mailto| 
Sent: Tuesday, February 11, 2014 12:34 PM 


[Quoted text hidden} 


[Quoted text hidden} 
[Quoted text hidden] 


Monica Hanle: Tue, Feb 11, 2014 at 12:56 PM b6 
To: z b7C 
i'm home now 


should i click on the same link that you sent this morning? 
[Quoted text hidden} : 


Tue, Feb 11, 2014 at 12:59 PM b6 
fo: Monica Hanley b7C 


I'll have to send you a new one, standby 


From: Monica Hanley (mait{ sd b6 
Sent: Tuesday; February 11, 2014 12:57 PM bic 


[Quoted text hidden} 


[Quoted text hidden} 
[Quoted text hidden} 


Tue, Feb 11, 2014 at 12:59 PM b6 
To: Monica Hanle: b7C 


https://broker.gotoassist.con/h/citrixassist? Question=DR960-073-880 


From: Monica Hanley | b6 
Sent: Tuesday, February 11, 2014 12: b7C 


[Quoted text hidden} 
[Quoted text hidden} 
[Quoted text hidden} 
Tue, Feb 11,2014 at 1:03PM. bs 
b7c 
4of 6 6/23/16, 3:29 PM 
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1am back in, thanks. 


lam still having problems connecting to the server. |am enlisting, _felp since he has a similar setup, he b6 
should be sending me some screenshots soon b7Cc 


’ From: Monica Hanley Imait{ =i b6 


Sent: Tuesday, February 11, 2014 12:57 PM b7C 


[Quoted text hidden} 


[Quoted text hidden} 
[Quoted text hidden} 


b6 


Tue, Mar 25, 2014 at 4:42 PM 
b7C 


Hi guys - just following up on this. Let me know when the wiped laptop is ready to be shipped[ Jest to send 
it to the foundation at: 


Hillary Rodham Clinton 

old 

1271 Avenue of the Americas 
42nd Floor 


New York, NY 10020 


Let me know once it's gone out so we know to expect it. Thanks[____| 


On Mon, Feb 10, 2014 at 9:03 PM, Monica Haney| wrote: b6 
b7c 


[Quoted text hidden] 


Fri, Apr 4, 2014 at 10:09 AM be 
b7c 


Just checking back on tisl Js it still with you? Thank | 


[Quoted text hidden] 


ey i 2014 at 10:11 AM b6 
To gmai.com>, Monica Hanley pic 


Sorry, missed this the first time around. Yes, the email has been imported into an archive mailbox on the 
server, and | can send the mac back to you soon 
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Sent: Friday, April 04, 2014 10:10 AM 


To: Monica Hanle’ 
<M 


https://mail .google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


b6é 
Subject: Re: HRC emails b7Cc 
Just checking back on this, is it still with you? Thank vf | 
[Quoted text hidden] 
[Quoted text hidden} 
Monica Hanle’ Sat, Apr 5, 2014 at 11:54 AM b6 
To b7C 
Ci gmail.com> 
hi! 4 i 
| know | don't work with you anymore so no need to reply to me but if HRC wants access to her email, can she 
now access it through the ee | | think you should update Huma and__bn where all of her old email is. 
[Quoted text hidden} 
Sat, Apr 5, 2014 at 1:55 PM be 
b7c 


makes sense! would love the details - thanks! 
[Quoted text hidden] 


6/23/16, 3:29 PM 
HRC-2247 


Gmail[__ address hutps://mail. google. com/mail/w0/?ui=2&ik=cb482b6546&view=pt... P6 
b7c 


M1 Gmail Wonca Hanlf——]}**. 


5 messages 


_————— ye eet ee Teena b6é 
Tue, Feb 11, 2014 at 3:23 PM b7c 
To: "Monica Hanley 


Here’s my home address where | work from: 


This email has been scanned for email related threats and delivered safely by Mimecast. 
For more information please visit http:/Awww.mimecast.com 


mi Mon, Feb 24, 2014 at 11:29 AM b6 
To b7c 


finally sent this out so u will receive tomorrow. 
tracking number is 8046 1373 3770 
pw is eithe 


let me know if you need anything and thanks! 


[Quoted text hidden} 
Mon, Feb 24, 2014 at 11:40 AM be 
0: mot b7C 
Thanks! 


From: mon imate b6 
Sent: Monday, February 24, 2014 11:29 Al b7c 
To, 

Subject: Re: iddress 


lof 2 6/23/16, 3:28 PM 
HRC-2248 


Gmail[7___ ddress 


2of 2 


[Quoted text hidden] 
[Quoted text hidden] 


‘To: mor 


https://mail.google.com/mail/w/0/?ui=2&ik=cb482b6546&view=pt... 


Tue, Feb 25, 2014 at 1:22 PM 


Monica, | received the laptop, | will put some ume on my calendar this week to get the email exported and put 


onto the server. Best of luck in your next job! 


From: mon [mailt 
Sent: Monday, F ary 24, 2014 11:29 AM 
To 

Subject: Ri laddress 
finally sent this out so u will receive tothorrow. 


[Quoted text hidden] 
[Quoted text hidden} 


terrific. thank you! 
[Quoted text hidden} 


Tue, Feb 25, 2014 at 2:02 PM 


6/23/16, 3:28 PM 
HRC-2249 


b6 
b7C 


b6 
b7C 


b6 
b7C 


b6 
b7C 


Gmail - HRC - time sensitive https://mail.google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


mM Gmail Monica Haney es 


HRC - time sensitive 


3 messages 

Mor Mon, Sep 23, 2013 at 8:14 PM b6 
Ri a 4 b7c 
To} 


, its monica w HRC. Her berry got creamed. I'm on my way out to buy a berry for her but are you avail to 
help with the enterprise activation tonight? Pls let me rods my cell 


Monica Hanle Thu, Oct 3, 2013 at 4:35 PM b6 
To: b7c 


n_] so we are going for the transfer tomorrow 
pw for enterprise activation is still the same as you told me on the phone? 
[Quoted text hidden] 


Thu, Oct 3, 2013 at 4:37 PM b6 
}0: Monica Hanle! b7c 


| will set it again- it clears after each activation. It will bd_bgain. 


V'll be arou nd tomorrow if you run into any problems 


Sei ‘hursday, October 03, 2013 4:35 PM b7C 
To; 
Subject: Re: HRC - time sensitive 


[Quoted text hidden} 


lof , 6/23/16, 3:30 PM 
, HRC-2250 


Gmail - HRC BB https://mail google.com/mail/u/0/2ui=2&ik=cb482b6546&view=pt... 


M1 Gmail MonicaHenief 


b7C 
HRC BB 
9 messages 
Mon, Oct 7, 2013 at 11:38 AM -_ 
To: Monica Hanley} bic 


Hi Monica- 


| take it everything went fine with HRC’s new blackberry, since we didn’t receive any calls/emails from you. .Let 
me know if otherwise J 


b7C 
Mon| Wed, Oct 9, 2013 at 9:52 AM 
Reply-To} 
To| 
Hi 


Yes the enterprise activation went off without a hitch, id the switch. 

There are a couple of preference and apps that can't figure out how to download (like a google search app) 

but I'll take a stab at it when | see her on sunday. 

\ have the laptop today and good wifi if you have time to do the email switchy-tranfer thing today. 
ee b6 
Date: Mon, 7 Oct 2013 15:38:47 +0000 b7C 
To: Monica Hanley} 

Subject: HRC BB 


Hi Monica- 


\ take it everything went fine with HRC’s new blackberry, since we didn't receive any calls/emails from you. Let 
me know if otherwise J 


Wed, Oct 9, 2013 at 9:54 AM be 
Tol b7c 


I'd like to set up a remote control session on the Mac- what email address would be best to send the link to, for 


1of3 6/23/16, 3:27 PM 


HRC-2251 


Gmail - HRC BB https://mail .google.com/mail/u/0/2ui=2&ik=cb482b6546&view=pt... 


you to get it on the archive laptop ? 


Sent: Wednesday, October 09, 2013 9:53 AM b7C 
Screnl 
Subject: Re: 


{Quoted text hidden} 


b6 


Wed, Oct 9, 2013 at 9:56 AM 
. b7C 


This on 
Also, can we reset her password at some point today? 


a ae = 


Date: Wed, 9 Oct 2013 13:54:25 +0000 b7C 
To| 


Subject: RE: HRC BB 
[Quoted text hidden] 


Wed, Oct 9, 2013 at 9:59 AM BS 
To: b7C 


We can reset HRC’s password anytime you'd like. You can either tell me what to set it to, or the more secure 
option would be to login to webmail, then click Options > Change password in the upper right corner of the 
webmail interface. Let me know if you need any help with that. 


Here's the remote control code for the archive laptop, please fire this up from the laptop and accept any prompts 
to open/run/download/etc and we should get hooked up. The code is only good for 30 min, so if you're busy and 
we need to delay this a bit, let me know when you're ready and | can generate a new one. 


https://broker.gotoassist. com/h/citrixassist?Question=DR988-932-848 


=I 


Sent: Wednesday, October 09, 2013 9:57 AM b7c 


[Quoted text hidden] 


2 of 3 6/23/16, 3:27 PM 
HRC-2252 


Gmail - HRC BB https://mail .google.com/mail/u/0/?ui=2&ik=cb482b6546&view=pt... 


[Quoted text hidden] 
Mot Wed, Oct 9, 2013 at 10:00 AM b6 
Reply-To: . b7c 
To 


Yes sorry won't be by wifi until 11am. Is that ok? 


Fro b6 
Date: Wed, 9 Oct 2013 13:59:40 +0000 Bue 
[Quoted text hidden] re 


Wed, Oct 9, 2013 at 10:03 AM bé 
7a b7c 


Totally fine, send me another email when you're good to go 


Sent: Wednesday, October 09, 2013 10:01 AM b7C 


[Quoted text hidden} 


[Quoted text hidden] 
Monit Wed, Oct 9, 2013 at 11:15 AM b6é 
To; b7c 

ready! 


[Quoted text hidden] 


Wed, Oct 9, 2013 at 11:17 AM be 
To: Monica Hanle) b7C 


Here you go: https://broker.gotoassist.com/h/citrixassist? Question=DR963-61 7-436 


From: Monica Hanley [mailto} b6 
Sent: Wednesday, October 09, 2013 11:16AM bic 
(Quoted text hidden} 
[Quoted text hidden] 

3 of 3 6/23/16, 3:27 PM 


HRC-2253 


Gmail - Remote link https://mail .google.com/mail/u/0/2ui=2&ik=cb482b6546&view=pt... 


b7c 


M1 Gmail Monica Hanif] »* 


Remote link 
1 message 


Wed, Oct 9, 2013 at 11:40 AM be 
To: Monica Hanley b7C 


https://broker.gotoassist.com/h/citrixassist? Question=DR051-438-752 


lofi 6/23/16, 3:28 PM 


HRC-2254 


Gmail - Computer https://mail.google.com/mail/w/0/2ui=2&ik=cb482b6546&view=pt... 


M Gmail Moni Hanif 


Computer 
8 messages 


Huma Abedin <! Ia@clintonemail > Wed, Oct 16, 2013 at 9:01 AM 
To! b6 


b7C 
| cannot get into my outlook. 
Keeps saying my name or pw isn't correct. Did they do something to our system? 


Monica Hanley| Wed, Oct 16, 2013 at 9:11 AM b6 
To: Huma Abedin <Huma@clintonemail.com>| b7C 


not that i know of. 
Did you use this website? 
https://mail.clintonemail.com/owa 


Addin___]to confirm. 


[Quoted text hidden] 


Wed, Oct 16, 2013 at 9:20 AM b6 
To: Monica Hanle Huma Abedin <Huma@clintonemail.com> ; b7Cc 


Hi Huma- Please let me know what method you are using to access your email (web, Outlook, mobile device, 
etc). Also please try your username/password on the site below from Monica. | can reset your password if 
necessary. 


CL] 


From: Monica Hanley [maito[ Cd b6 
Sent: Wednesday, October 16, 2013 7:12 AM b7c 
To: Huma Abedin; 

Subject: Re: Computer 


[Quoted text hidden] 


Hu 1AM 
To: b6 


b7Cc 


On the web using that site below. 
Keep getting same message 


Sent: Wednesday, October 16, 2013 09:20 AM Eastern Standard Time mie 


-Lof3 6/23/16, 3:27 PM 
HRC-2255 


Gmail - Computer https://mail.google.com/mail/w/0/2ui=2&ik=cb482b6546&view=pt... 


2 of 3 


To: Monica Hanley [Huma abedin bs 


Subject: RE: Computer b7C 


[Quoted text hidden] 


Wed, Oct 16, 2013 at 9:41 AM b6é 


Huma- | have set your password to not expire, please try again. If it still gives the same message, | will reset 
your password and you can change it to whatever you'd like 


From: Huma Abedin [mailto:Huma@clintonemail.com] 


Sent: Wednesday, October 16, 2013 7:31 AM 


Subject: Re: Computer b7C 
[Quoted text hidden] 
H i - 3 at 9:42 AM 
To} b6 
b7C 
SUCCESS 
thank you! 
From; BS 
b7C 


Sent: Wednesday, October 16, 2013 9:41 AM 
To: Huma Abedin; 
Subject: RE: Computer 


[Quoted text hidden] 
Huma Abedin <Huma@ciintonemail.com> Wed, Oct 16, 2013 at 9:41 AM 
b7C 
Not sure what you did but it works after 35 times of trying! 
From: Huma Abedin 
Sent: Wednesday, October 16, 2013 09:31 AM Eastern Standard Time 
b6 
b7C 


i computer 


[Quoted text hidden] 


HREEZIEM 


Gmail - Computer https://mail .google.com/mail/u/0/?ui=2&ik=cb482b6546 &view=pt... 


Wed, Oct 16, 2013 at 9:42 AM a 


Great! | set your password to not expire, | think it had just run out of time. It won’t do so again 


From: Huma Abedin [mailto: Huma@clintonemail.com] 


Sei 
To; b6 
Subject: Re: Computer b7c 
Not sure what you did but it works after 35 times of trying! 
{Quoted text hidden] 
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oe 


Field Office Acquiring Evidence W& a0) 


Serial # of Originating Document 2 4 


Date Received 10 -24-) om 


‘ame of Contributor/Interviewee) 
DS | ict le. 
Ao Uke 


(City and State) 


(Address) 


By 


To BeRetumed [] Yes Ne 
Receipt Given [1] Yes \ lo 


Grand Jury Material - Disseminate’ ily Pursuant to Rule 6 (e) 


Federal Rules of Criminal Procedure 


O bia PR 


Federal Taxpayer Information (FTI)' 


| Ge. 
Title: Uy. 


b7E Per DOS 
Reference: asf | it) ¢ 4 avd SF: 312 (6) 
Tommunication Enclosing rate 


Description: Original notes re interview of 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 12-09-2016 BY 376318T80 NSICG 


United States Department of State 


Washington, D.C. 20520 


TO: 
b7c 
i a b6 Per 
FROM: — DS/ICI/CI ine pas 
SUBJECT: Receipt of Files Transfer for DS/ICI/CI Case PI-00-US-15-57 
. . This.memo serves.as.a transfer receipt from the Diplomatic Security 
** Counterintelligence Division to the Federal Bureau of Investigations for the 
following items: 
b6 
Personal files of oe 


Personal files of 
Personal files of 
Personal files 
Personal Files 0 
Personal files o 


database search results b7E Per Dos 
responsive to the October 6 record request; ani 
e Signed SF-312 forms responsive to the October 6 record request. 


‘Signature below acknowledges receipt on behalf of the FBI: 


b6 
b7Cc 


[0-24- |S™ 
Date 


UNCLASSIFIED 
HRC-6304 


HEREIN IS UNCLASSIFIED 


eo ALL FBI INFORMATION CONTAINED 
q 
DATE 12-09-2016 BY J76318T80 NSICC 


United States Department of State 


Washington, D.C. 20520 


October 15, 2015 


MEMORANDUM 

" Z| ioati ivici ‘i b6 Per 
TO: DS/ICI/CI [_ investigations Division Chief Sees 
THROUGH: psicyci{___ NASA Section Chief 
FROM: psicvait 
SUBJECT: PI-00-US-15-57 


FBI 811 request for Production of Records: 


JSANFYOn 06 October 2015, DS/ICI/CI received a request for DS/ICI/CI database 

records for 35 State Department records in. The information was requested to satisfy a eR ey 
Section 811(c) that the FBI received from the Inspector General of the Intelligence b6 Per Dos 
Community. b7E Per Dos 


DYINBLIn furtherance of this investigation DS/ICI/CI was able to find records | 1g) 
for 16 of the 35 subj 


. 2 bé Per 
(80NF) DS/ICI/CI was only able to find five signed SF-312 forms from the October 6, 
2015 addition; b6 
b7c 


$87°NBK DS/ICI/CI has attached all of the found records from the employees. 


b6 Per 
APPROVE, DISAPPROVED: BIG POS. 
id Date) (Initial and Date) 


/NOFORN. 
Classified by| Division Chief DS/ICI/CI 
Reason: 1.4c; Declassify: 10/15/2040 


HRC-6305 


FBI-811 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 12-09-2016 BY 376918T80 NSICG 


HRC-6306 


b7E Per DOS 


a 
3 
a 
9 
Q 
m4 
= 


JBREREI7HOFORN- | 
peace. | 
bl Per DOS 


BUREAU OF DIPLOMATIC SECURITY a b6 Per DOS 


b7C Per DOS 
TITLE Counterintelligence Debriefings of U.S. 
Employees, American arc 


CASE CLASSIFICATION 


SYNOPSIS 


During CY 1992, approximately bi per pos 
48 employees departed post after completing a permanent change 
of station or a temporary duty assignment. The employees 
interviewed represented various U.S. government civilian and 
military agencies, and they were either interviewed by Special 
Agents of the Diplomatic Security Service or by Security 
officials of the other U.S. government agencies. Reports of 
of interviews are normally required, and copies are to be sent 
to the Regional Security Officer at the employees‘ last post. 
In addition to conducting the interviews, DS/CMI/CI officers 
tracked the employees to their new assignments (when possible) 
to insure that debriefings were completed. If information 
requiring additional investigation or follow-up was developed 
this office made every effort to see that it was done. 
Developed leads were forwarded to RSOs, other Federal agencies 
and other interested parties. All reports, related letters, 
memoranda, and correspondences are filed in the case file. 
Attached to this form is a list of the employees who were 
tracked and interviewed. This case is considered closed. 


- CLOSED - 


bl Per DOS 


DO NOT WRITE IN THIS SPACE 


Agent In Charge) ____|Date Received 


b6 Per 
b7c DOS 


Ori 


COPIES. REFERRED. 1.- bl Per DOS 


REVIEWED BY AGENT SUPERVISOR 


(Date) (Initials) 


(Formerly DS-838) 
MARCH 1975 


DEPT. OF STATE 


50249-101 


HRC-6331 


4 » 


United States Department of State 


Washington, D.C. 20520 


March 15, 1993 


b6 Per 
TO: DS/CMI/CI - Mr. ene 
FROM: ICS - John J. stein //f 


SUBJECT: SY-56-RS-92-151 (Missing Classified) 
Request to Close Case File 


92 Moscow 35238 advised that several confidential documents 
were missing from the files of political officer 
Subsequent investigation by DS/CR/SI and RSO b6 
Moscow indicated that the documents probably never left the b7C 
core, and the political section damage assessment indicated 
that the documents may have been inadvertently shredded. 
DS/CR/SI considers the matter closed. Consultations with 
DS/CR/SI and a review of the case papers did not surface 
anything of CI interest. 


No further CI action warranted. Request case be closed. 


APPROVE DISAPPROVE. 


DATE: Zi = 


DECL:OADR b6 Per 
Drafted b7c DOS 


HRC-6369 


ALL FBI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 12-09-2016 BY J76318T80 NSICG 


United States Department of State 


Washington, D.C. 20520 


October 15, 2015 


TO: psicvct{ investigations Division Chief peas 
THROUGH: psacvct{___]NAS< Section Chief 

FROM: psicvat{___—_—sd| 

SUBJECT: PI-00-US-15-57 


FBI 811 request for Production of Records: 


$S¢/NF) On 06 October 2015, DS/ICI/CI received a request for DS/ICI/CI database 
records for 35 State Department records in. The information was requested to satisfy a 
Section 811(c) that the FBI received from the Inspector General of the Intelligence 
Community. 


SANEHIn furtherance of this investigation DS/ICI/CI was able to find the employee 


records for 16 of the 35 subjects. The employees with records found wer ve 
c 


a 

YKLANB} DS/ICI/CI was unable to find any signed SF-312 forms for everyone on the 

October 6, 2015 addition except fo: b6 
b7c 


ney DS/ICI/CI has attached all of the found records from the employees. 


APPROVED: DISAPPROVED: 
(Initial and Date) (Initial and Date) 


VOFORN 


Classified by| =—=—————S——sd| Divisiom Chief DS/ICI/CI pe eee 
Reason: 1.4¢; Declassify: 10/15/2040 


HRC-6370 


HRC-6371 


oF-312 


CLASSIFIED INFORMATION NONDISCLOSURE AGREEMENT 


AN AGREEMENT BETWEEN AND THE UNITED STATES, 
(Name of Individual — Printed or typed) 


1. Intending to be legally bound, | hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
Statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2, 1.3 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. | understand and accept that by being granted access to classified information, special confidence and 
trust shall be placed in me by the United States Government. 


2. | hereby acknowledge that | have received a security indoctrination concerning the nature and protection of classified information, 
including the procedures to be followed in ascertaining whether other persons to whom | contemplate disclosing this information have 
been approved for access to it, and that | understand these procedures. 


3. Ihave been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. | hereby agree that | 
will never divulge classified information to anyone unless: (a) | have Officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) | have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. | understand that if | am uncertain about the classification status of 
information, | am required to confirm from an authorized official that the information is unclassified before | may disclose it, except to a 
person as provided in (a) or (b), above. | further understand that | am obligated to comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 


4. Ihave been advised that any breach of this Agreement may result in the termination of any security clearances | hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. in addition, | have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the 
provisions of Sections 641, 793, 794, 798, *952 and 1924, Title 18, United States Code, *the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. | recognize that nothing in the Agreement 
Constitutes a waiver by the United States of the right to prosecute me for any statutory violation. 


5. | hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 


6. | understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 


7. (understand that all classified information to which | have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the control of the United States Government unless and until otherwise determined by an authorized 
official or final ruling of a court of law. | agree that | shall return all classified materials which have, or may come into my possession or 
for which | am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (C) upon the conclusion of my employment or other 
telationship that requires access to classified information. If | do not retum such materials upon request, | understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 


8. Unless and until | am released in writing by an authorized representative of the United States Government, | understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time | am granted access to classified information, 
and at all times thereafter. 


9. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to be unenforceable, all other 
provisions of this Agreement shall remain in full force and effect. Ee ae 
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10. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section 7211 of Title 5, United States code (governing disclosures to Congress); Section 
1034 of Title 10, United States code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by 
members of the military); Section 2302(b) (8) of Title 5, United States Code, as amended by the Whistleblower Protection Act 
(governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Govemment agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, 952 and 1924 of Title 18, United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. 


11.1 have read this Agreement carefully and my questions, if any, have been answered: | acknowledge that the briefing officer has 
made available to me the Executive Order and statutes referenced in this agreement and its implementing regulation (32 CFR Section 
2003.20) so that | may read them at this time, if | so choose. 


5 ‘SOCIAL SECURITY NUMBER b6 Per DOS 


DATE (mm-dd-yyyy) 


Or (3 - 2007 
J2-03-2009 
IN (IF CONTRACTOR, LICENSEE, GRANTEE OR AGENT, PROVIDE: NAME, ADDRESS, AND iF APPLICABLE, FEDERAL SUPPLY CODE NUMBER) 
(Type or print) 


Circle one: GS FS PSC WAE Contractor Intem Other__ 


Bureau Assigned: Ss Telephone:( ) - 


WITNESS 
THE EXECUTION OF THIS AGREEMENT WAS WITNESSED 


ACCEPTANCE 


THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 
GOVERNMENT. 


SiG} - DATE imm-deyyy) DATE (mmddyy) PTC DOS 


BY 


02-03-2009 02-03-2009 


‘or print) 


SA-20, 13th fl. DS/IS/APD -20, . ‘APD 
Le North Lynn Si 1801 North Lynn Street, 
in 


Arlington, Virginia 22209 


571-345-3066 


street, 
n, Virginia 22209 
571-345-3066 


SECURITY DEBRIEFING ACKNOWLEDGMENT 


| reaffirm that the provisions of the espionage laws, other federal criminal laws and executive orders applicable to the safeguarding of classified 
information have been made available to me; that | have retumed all classified information in be Barve ; that | will not communicate or transmit 
classified information to any unauthorized person or organization; that | will Promptly report to the Federal Bureau of Investigation any attempt by an 
unauthorized person to solicit classified information, and that | (have) (have not) (strike out inappropriate word or words) received a security debriefing. 


‘SIGNATURE OF EMPLOYEE 


DATE (mm-dd-yyyy) 


NAME OF WITNESS (Type or print) [SIGNATURE OF WITNESS 


NOTICE: The Privacy Act, 5 U.S.C. 552a, requires that federal agencies inform individuals, at the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is solicited, and what uses will be made of the information. You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
is necessary to 1) certify that you have access to the information indicated above or 2) determine that your access to the information indicated has 


terminated. Although disclosure of your SSN is not ireanctedony, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. 


“NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. 
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CLASSIFIED INFORMATION NONDISCLOSURE AGREEMENT 


AN AGREEMENT BETWEEN AND THE UNITED STATES 


or typed) 


4. Intending to be legally bound, | hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2, 1.3 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. 1 understand and accept that by being granted access to classified information, special confidence and 
trust shall be placed in me by the United States Government. 


2. | hereby acknowledge that | have received a security indoctrination conceming the nature and protection of classified information, 
including the procedures to be followed in ascertaining whether other persons to whom | contemplate disclosing this information have 
been approved for access to it, and that | understand these procedures. 


3. [have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. | hereby agree that | 
will never divulge classified information to anyone unless: (a) ! have officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) | have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. | understand that if | am uncertain about the classification status of 
information, | am required to confirm from an authorized official that the information is unclassified before | may disclose it, except to a 
person as provided in (a) or (b), above. | further understand that | am obligated to comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 


4. |have been advised that any breach of this Agreement may result in the termination of any security clearances | hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. In addition, | have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the 
provisions of Sections 641, 793, 794, 798, *952 and 1924, Title 18, United States Code, “the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. | recognize that nothing in the Agreement 
constitutes a waiver by the United States of the right to prosecute me for any statutory violation 


5. | hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 


6. 1 understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 


7. {understand that all classified information to which | have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the contro! of the United States Government unless and until otherwise determined by an authorized 
official or final ruling of a court of law. | agree that | shall return all classified materials which have, or may come into my possession or 
for which | am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (c) upon the conclusion of my employment or other 
relationship that requires access to classified information. If ! do not retum such materials upon request, | understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 


8. Unless and until | am released in writing by an authorized representative of the United States Government, | understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time ! am granted access to classified information, 
and at all times thereafter. 


9. Each provision of this Agreement is severable. If a court HOUMA fir find eny provision of this Agreement to be unenforceable, all other 
provisions of this Agreement shall remain in full force and effect. 
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10. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section 7211 of Title 5, United States code (governing disclosures to Congress); Section 
1034 of Title 10, United States code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by 
members of the military); Section 2302(b) (8) of Title 5, United States Code, as amended by the Whistleblower Protection Act 
(governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Government agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, 952 and 1924 of Title 18, United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. - 


. if any, have been answered. | acknowledge that.the briefing officer has 
renced in this agreement and its implementing regulation (32 CFR Section 
b6 Per DOS 


SOCIAL SECURITY, 
(See Notice below) 


ROVIDE: NAME, ADDRESS, AND IF APPLICABLE, Fel 
(Type or print) 


Circle one: Gs FS PSC WAE Contractor Intern Other__ 


Bureau Assigned: Telephone:( ) = - 


ACCEPTANCE 


THE EXECUTION OF THIS AGREEMENT WAS WITNESSED | THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 
BY THE UNDERSIGNED. BEHALF OF THE UNITED STATES GOVERNMENT. 


-20, 13¢ IS‘APD 
1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


A-20, 13th f. D 
1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


SECURITY DEBRIEFING ACKNOWLEDGMENT 


jws, other federal criminal laws and executive orders applicable to the safeguarding of classified 
have retumed all classified information in my custody; that | will not communicate or transmit 
ni ; that | will promptly report to the Federal Bureau of Investigation any attempt by an 

ave) (have not) (strike out inappropriate word or words) received a security debriefing. 


| reaffirm that the provisions of the espi 
information have 
classified information| 
unauthorized person 


‘SIGNATURE OF EMPL DATE (mm-do-yyyy) 1 
b6 Per 


b7c DOS 


[SIGNATURE OF WITNESS i 


i 
| 
i 
NOTICE: The Privacy Act, 5 U.S.C. 552a, requires that federal agencies inform individuals, at the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is solicited, and what uses will be made of the information. You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
is necessary to 1) certify that you have access to the information indicated above or 2) determine that your access to the information indicated has 
terminated. Although disclosure of your SSN is not mandatory, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. 


*NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. 
STANDARD FORM 312 BACK (Rev. 1-00) 
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CLASSIFIED INFORMATION NONDISCLOSURE AGREEMENT 


AN AGREEMENT BETWEEN AND THE UNITED STATES 


typed) 


1. Intending to be legally bound, | hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2, 1.3 and 
1.4(@) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. | understand and accept that by being granted access to classified information, special confidence and 


trust shall be placed in me by the United States Government. 


2. | hereby acknowledge that | have received a security indoctrination concerning the nature and protection of classified information, 
including the procedures to be followed in ascertaining whether other persons to whom | contemplate disclosing this information have 
been approved for access to it, and that | understand these procedures. 


3. | have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. { hereby agree that | 
will never divulge classified information to anyone unless: (a) | have officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) | have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. | understand that if | am uncertain about the classification status of 
information, | am required to confirm from an authorized official that the information is unclassified before | may disclose it, except to a 
person as provided in (a) or (b), above. | further understand that | am obligated to comply with laws and regulations that prohibit the 


unauthorized disclosure of classified information. 


4. | have been advised that any breach of this Agreement may result in the termination of any security clearances | hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. in addition, | have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the 
provisions of Sections 641, 793, 794, 798, "952 and 1924, Title 18, United States Code, *the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. | recognize that nothing in the Agreement 
constitutes a waiver by the United States of the right to prosecute me for any statutory violation. 


5. | hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 


6. | understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 


7. | understand that all classified information to which | have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the contro! of the United States Government unless and until otherwise determined by an authorized 
official or final ruling of a court of law. | agree that | shall return all classified materials which have, or may come into my possession or 
for which | am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (c) upon the conclusion of my employment or other 
relationship that requires access to classified information. If | do not return such materials upon request, | understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 
8. Unless and until | am released in writing by an authorized representative of the United States Government, | understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time | am granted access to classified information, 
and at all times thereafter. ‘ 

4H, teres 
9. Each provision of this Agreement is severable. ff a court should find any ptovision of this Agreement to be unenforceable, all other 
provisions of this Agreement shall remain in full force and effect. Cs cand 
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40. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section 7211 of Title 5, United States code (governing disclosures to Congress); Section 
1034 of Title 10, United States code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by 
members of the military); Section 2302(b) (8) of Title 5, United States Code, as amended by the Whistleblower Protection Act 
(governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the intelligence Identities Protection Act of 
4982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Government agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, 952 and 1924 of Title 18, United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. 

11. | have read this Agreement carefully and my questions, if any, have been answered. | acknowledge that the briefing officer has 
made available to me the Executive Order and statutes referenced in this agreement and its implementing regulation (32 CFR Section 
2003.20) so that | may read them at this time, if | so choose. 


‘SK i DATE (mm-o0-yyyy) SOCIAL SECURITY NUMBER b6 Per DOS 
ry _ if 
NOV 37 28 


ORGANIZATION (IF CONTRACTOR, LICENSEE, GRANTEE OR AGENT, PROVIDE: NAME, ADDRESS, AND IF APPLICABLE, FEDERAL SUPPLY CODE NUMBER) 


(Type or print) 
Circle one: GS FS PSC WAE_ Contractor Intern other 


es 

Bureau Assigned: Stason Telephone: (22Y/7-GOFZF 

WITNESS ACCEPTANCE 

THE EXECUTION OF THIS AGREEMENT WAS WITNESSED | THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON b6 Per 
BI 


STATES GOVERNMENT. b7c DOS 


DATE (mm-dc-yyyy) 


NOV 47 208 


DATE (mm-de-yyyy) 


NOY 77 2B 


Ye OF prit 


SA-20, }3th fl. DS/IS/APD 
1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


SECURITY DEBRIEFING ACKNOWLEDGMENT 


| reaffirm that the provisions of the espionage laws, other federal criminal laws and executive orders applicable to the safeguarding of classified 
information have been made available to me; that | have returned all classified information in my custody; that | will not communicate or transmit 
classified information to any unauthorized person or organization; that ! will promptly report to the Federal Bureau of Investigation any attemp! by an 
unauthorized person to solicit classified information, and that | (have) (have not) (strike out inappropriate word or words) received a security debriefing 


DATE (mm-dd-yyyy) 


NAME OF WITNESS (Type or print) SIGNATURE OF WITNESS 


NOTICE: The Privacy Act, 5 U.S.C. 552e, requires that federal agencies inform individuals, at the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is solicited, and what uses will be made of the information. You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
is necessary to 1) certify that you have access to the information indicated above or 2) determine that your access to the information indicated has 
terminated. Although disclosure of your SSN is not mandatory, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. 


*NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. 
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ON NONDISCLOSURE AGREEMENT _ 
AND THE UNITED STATES 


Ti 


‘AN AGREEMENT. 


1. Intending to be legally bound, I hereby accept the obligations contained in this Agreement in. consideration of .my being 
granted access to classified information. As used in this Agreement, classified information is marked or unmarked classified 
information, including oral communications, that is classified under.the standards of Executive Order 12356,-or under any. other 
Executive order or statute that prohibits the unauthorized disclosure of information in the interest of national security; and 
unclassified information that meets:the standards for classification and is in the process of .a classificagion determination as 
provided in Sections 1.1 and 1:2(e) of Executive Order 12356, or under any other Executive order or statute that requires 
protection for such information in the interest of national security. I understand and accept that by -being granted access to 
classified information, special confidence and trust shall be placed in me by.the United States Government. 


2. I hereby acknowledge that .J have received a sécurity indocurination concerning the nature and protection of classified 
information, including the procedures to be followed in ascertaining whether other persons to whom I contemplate disclosing this 
information have been approved for access'to it, and that I understand. these procedures. 


3. Thave been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information 
by me could cause damage or irreparable injury to the United States or could be used-to advantage by a foreign nation. I hereby 
agree-that I will never divulge classified information to anyone unless: (a) I have. officially verified that the recipient has been 
properly atithorized by the United States Government to réceive it; or (b) Mhave been given prior writen notice of authorization 
from the United States Government Department -or Agency (hereinafter Department or Agency) responsible ‘for the 
classification of ‘the information or‘last granting me a security clearance that such disclosure is permited. I understand that if 
I am uncertain about-the classification status ‘of information, I-am required to confirm from an, authorized official that the 
information is unclassified before I may disclose it, except to a'person'as provided in (a) or (b), above. I further understand that 
1 am obligated to comply with laws and regulations that prohibit the unauthorized ‘disclosure of classified information. . 

4, Ichave been advised that any breach. of this Agreement may result in the termination of any security cléarances I hold; 
femoval from any position of special confidence and trust requiring such clearances; or the termination of my employment or 
other relationships with the Departments or Agencies that granted my security clearance or clearances. In addition, I have been 
advised that ay unauthorized disclosure of classified information by me may constitute a violation, or violations, of United 
States criminal laws, including the provisions of Sections 641, 793, 794, 798, and °952, Title 18, United. States Code, 
*the provisions of Section 783(b), Title 50; United States Code, and thé provisions of the Intelligence Identities. Protection Act: 
of 1982. I recognize that nothing in this Agréement constitutes a waiver by the United States of the right to prosecute me for any 
statutory violation. 7 ; 

5, ‘hereby assign to the United States Government all royalties, rémunerations, and emoluments that have resulted, will result 
or may result from any disclosure, publication, or revelation of. classified information not consistent with the terms of this 
Agreement, " = 7 ? 

6, Lunderstand that the United States Government may. seek any remedy available to it to’ enforce this. Agreement including, 
but not limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 


7. understand that all classified information to which J have access or.may obtain-access by signing this Agreement is now and 
will remain the property of, or under the control of the United States Government unless and-until otherwise determined by an 
authorized‘ official or final ruling-of a-court of law. I agree that I shall return all classified materials which have, ‘or may come into 
my possession, or for which I-am responsible because of such:access: (a) upon demand by an authorized representative of the 
‘United States Government; (b) upon the conclusion’ of. my employment or.other relationship with the:Depattment! or Agency 
that last granted me a security clearance or that provided me access to classified information; or (c) upop thé'coriclsion of my 
employment or other relationship that requires access to classified-information. If I do not return such»matériils. upon request, 
I understand that this may.be a violation of Section 793, Title 18,, United States Code, a. United. States criminal law. 


8. Unless and until I am released in. writing by an authorized representative of the United States. Govémaidnt, ‘lunderstand 
that all conditions and obligations imposed upon me by this Agreement apply during the'time I am granted access to classified 
information, and at all times thereafter. : oP 3 ‘ 

9. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to Be unenforceable, 
all other provisions of this Agreement shall remain in full force and effect. ame 
10. These.restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights 
or liabilides created by Executive Order 12356; Section 7211 of Tide 5, United States Code (governing disclosures to Congyess); 
Section 1034 of Title 10, United States Code, as-amended by the Military Whistleblower Protection Act (governing disclosure 
to Congress by. members of tie military); Section 2302(0) (8) of Title 5, United-States Code, as amended by the Whistleblower 
Protection Act (governing disclosures of illegality, waste, fraud, abuse or public Health or safety threats); the Intelligence 
Identities Protection Act of 1982 (50 U.S.C. 421 et seq.) (governing disclosures that could expose confidendal Government 
agents); and the statutes.which protect against disclosure that may compromise ‘the. national:security, including Sections 641, 
793, 794, 798, and 952 of Title 18; United. States Code, and.Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. 
Section 783(b)). The definitions, requirements, obligations, rights, sinctions and liabilities created by ‘said Executive Order arid 
listed, statutes are incorporated into this Agreément and are controlling. HRC-6378 
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11. Ihave read this Agreement careful my questions, if any, have been answe; knowledge that the briefing officer 
has made available to me the Execut der and statutes referenced in this A| ent and its implementing regulation 
(32 CER Section 2003.20) so that I may read them at this time, if I so choose. 


SOCAL SECURITY NUMBER ‘b6 Per DOS 


(See Notice - 


, PROVIDE: NAME, ADDRESS, AND, IF APPLICABLE, FEDERAL SUPPLY CODE NUMBER) 


2 


ACCEPTANCE 


THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 
BEHALF OF THE UNITED STATES GOVERNMENT. b6 Per 
b7c DOS 


THE EXECUTION OF THIS AGREEMENT WAS WITNESSED 
‘BY THE UNDERSIGNED. zn 


DS = APB 


Department of State 
2201, C Street, N.W. 
Washington, D.C. 20520 


DS/ISP/APB 

Department of State 
2201 C Street, N.W. 
Washington, D.C. 20520 


nae 


* SECURITY DEBRIEFING ACKNOWLEDGEMENT 


I reaffirm that the provisions of the espionage laws, other federal criminal Jaws and executive orders applicable to the safeguarding of classified" 
information have been made available to me; that [ have returned-alll claésifled Information in my custody; that I will not communicate or trarismit 
classified information to any unauthorized person or organization; that I-will promplly report to the Federal Bureau of Investigation any attempt by an 
upanthorized person to solicit classified information, and that I (have) (have not) (strike out inappropriate word or words) received a security 
debriefing. 4 : 


NAME OF WITNESS (Type or priat) 


NOTICE: The Privacy Act, 5 U.S.C. $522, requires that federal agencies Inform Individuals, at the tine faformation fs solicited from them, whether the disclosure Is mandatory 
or voluntary, by what aathority such faformation f s8ticited, and what uses will be made of the Laformatlod. You are hereby advised that authority for soliciting your Social 
Securlly Account Nursber (SSN) Is Executive Order 9397. Your SSN will be used to Identity you precisely when It Is necessary to 1) certify that you have access to the 
Information Indicated above or 2) determine that your access to the laformation Indicated has terminated, Although disclosure of your SSN is not mandatory, your failure to do 
40 may Impede the procesting of such certifications or determications, of pomibly result [a the denial of your being granted access to classified [nformaation. 


* NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. 
STANDARD FORM 312 BACK (REV. 1-91) 
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CLASSIFIED INFORMATION NONDISCLOSURE AGREEMENT 


AN AGREEMENT BETWEEN AND THE UNITED STATES bee 


1. Intending to be legally bound, | hereby accept the obligations contained in this Agreement in consideration of my being granted 
access to classified information. As used in this Agreement, classified information is marked or unmarked classified information, 
including oral communications, that is classified under the standards of Executive Order 12958, or under any other Executive order or 
statute that prohibits the unauthorized disclosure of information in the interest of national security; and unclassified information that 
meets the standards for classification and is in the process of a classification determination as provided in Section 1.1, 1.2, 1.3 and 
1.4(e) of Executive Order 12958, or under any other Executive order or statute that requires protection for such information in the 
interest of national security. | understand and accept that by being granted access to classified information, special confidence and 
trust shall be placed in me by the United States Government. 


2. hereby acknowledge that | have received a security indoctrination concerning the nature and protection of classified information, 
including the procedures to be followed in ascertaining whether other persons to whom | contemplate disclosing this information have 
been approved for access to it, and that | understand these procedures. 


3. | have been advised that the unauthorized disclosure, unauthorized retention, or negligent handling of classified information by me 
could cause damage or irreparable injury to the United States or could be used to advantage by a foreign nation. | hereby agree that | 
will never divulge classified information to anyone unless: (a) | have officially verified that the recipient has been properly authorized by 
the United States Government to receive it; or (b) | have been given prior written notice of authorization from the United States 
Government Department or Agency (hereinafter Department or Agency) responsible for the classification of information or last granting 
me a security clearance that such disclosure is permitted. | understand that if | am uncertain about the classification status of 
information, | am required to confirm from an authorized official that the information is unclassified before | may disclose it, except to a 
person as provided in (a) or (b), above. | further understand that | am obligated to comply with laws and regulations that prohibit the 
unauthorized disclosure of classified information. 


4. Ihave been advised that any breach of this Agreement may result in the termination of any security clearances | hold; removal from 
any position of special confidence and trust requiring such clearances; or termination of my employment or other relationships with the 
Departments or Agencies that granted my security clearance or clearances. In addition, | have been advised that any unauthorized 
disclosure of classified information by me may constitute a violation, or violations, of United ‘States criminal laws, including the 
provisions of Sections 641, 793, 794, 798, *952 and 1924, Title 18, United States Code, *the provisions of Section 783(b), Title 50, 
United States code, and the provisions of the intelligence Identities Protection Act of 1982. | recognize that nothing in the Agreement 
constitutes a waiver by the United States of the right to prosecute me for any statutory violation. 


5. | hereby assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result or may 
result from any disclosure, publication or revelation of classified information not consistent with the terms of this Agreement. 


6. | understand that the United States Government may seek any remedy available to it to enforce this Agreement including, but not 
limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. 


7. | understand that all classified information to which | have access or may obtain access by signing this Agreement is now and will 
remain the property of, or under the control of the United States Government unless and until otherwise determined by an authorized 
official or final ruling of a court of law. | agree that | shall return all classified materials which have, or may come into my possession or 
for which | am responsible because of such access: (a) upon demand by an authorized representative of the United States 
Government; (b) upon the conclusion of my employment or other relationship with the Department or Agency that last granted me a 
security clearance or that provided me access to classified information; or (c) upon the conclusion of my employment or other 
relationship that requires access to classified information. If | do not return such materials upon request, | understand that this may be 
a violation of Sections 793 and/or 1924, Title 18, United States Code, a United States criminal law. 


8. Unless and until | am released in writing by an authorized representative of the United States Government, | understand that all 
conditions and obligations imposed upon me by this Agreement apply during the time | am granted access to classified information, 
and at all times thereafter. 

Ht 
9. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to be unenforceable, all other 
provisions of this Agreement shall remain in full force and effec 


el 


(Continue on reverse.) 
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10. These restrictions are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights or 
liabilities created by Executive Order 12958, Section 7211 of Title 5, United States code (governing disclosures to Congress); Section 
1034 of Title 10, United States code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by 
members of the military); Section 2302(b) (8) of Title 5, United States Code, as amended by the Whistleblower Protection Act 
(governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 
1982 (50 U.S.C. 421 et seq.) (governing disclosures that expose confidential Government agents), and the statutes which protect 
against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, 952 and 1924 of Title 18, United 
State Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The definitions, requirements, 
obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement 
and are controlling. 

11.1 have read this Agreement carefully and my questions, if any, have been answered. | acknowledge that the briefing officer has 


made available to me the Executive Order and statutes referenced in this agreement and its implementing regulation (32 CFR Section 
2003.20) so that | may read them at this time, if | so choose. 


i DATE (mm-dd-yyyy) ‘SOCIAL SECURITY NUMBER b6 Per DOS 


H (See Notice below) 
H 01-26-2009 | acer (ee 
i NSEE, GRANTEE OR AGENT, PROVIDE: NAME, ADDRESS, AND IF APPLICABLE, FEDERAL SUPPLY CODE NUMBER) 


Type or print) 


Circleone: GS FS PSC WAE Contractor Intern Other__ 


Bureau Assigned: S Telephone:( ) - 


WITNESS ACCEPTANCE 


t THE EXECUTION OF THIS AGREEMENT WAS WITNESSED | THE UNDERSIGNED ACCEPTED THIS AGREEMENT ON 
BY THE UNDERSIGNED. BEHALF OF THE UNITED STATES GOVERNMENT. 


DATE (mm-dd-yyyy) DATE (mm-dd-yyyyyb6 Per 


01-26-2009 


01-26-2009 
- VBE OF pam 


[nected ay 


1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


SA-20, 13th fl. DS/IS/APD 
1801 North Lynn Street, 
Arlington, Virginia 22209 
571-345-3066 


SECURITY DEBRIEFING ACKNOWLEDGMENT 


| reaffirm that the provisions of the espionage laws, other federal criminal laws and executive orders applicable to the safeguarding of classified 
information have been made available to me; that | have returned all classified information in my custody; that | will not communicate or transmit 
classified information to any unauthorized person or organization; that | will promptly report to the Federal Bureau of Investigation any attempt by an 
unauthorized person to solicit classified information, and that I (have) (have not) (strike out inappropriate word or words) received a security debriefing. 


‘SIGNATURE OF EMPLOYEE DATE (mm-dd-yyyy) 


‘NAME OF WITNESS (Type or print) SIGNATURE OF WITNESS 


NOTICE: The Privacy Act, 5 U.S.C. 552a, requires that federal agencies inform individuals, at the time information is solicited from them, whether the 
disclosure is mandatory or voluntary, by what authority such information is solicited, and what uses will be made of the information. You are hereby 
advised that authority for soliciting your Social Security Number (SSN) is Executive Order 9397. Your SSN will be used to identify you precisely when it 
is necessary to 1) certify that you have access to the information indicated above or 2) determine that your access to the information indicated has 
terminated. Although disclosure of your SSN is not mandatory, your failure to do so may impede the processing of such certifications or determinations, 
or possibly result in the denial of your being granted access to classified information. 


*NOT APPLICABLE TO NON-GOVERNMENT PERSONNEL SIGNING THIS AGREEMENT. 
STANDARD FORM 312 BACK (Rev. 1-00) 
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